Apple Core Storage partition not found on Quick or Deeper Scan

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
HostileBlue
Posts: 2
Joined: 29 Nov 2021, 16:08

Apple Core Storage partition not found on Quick or Deeper Scan

#1 Post by HostileBlue »

Hi folks,

First thanks to cgsecurity for making this suite - awesome work!

I've ran into a problem, and I'm getting the same result on both Windows and Linux.

I've taken a dd img of a drive from an old apple laptop I own. I'm trying to recover data from the "Apple Core Storage" partition. I'm aware that there's a HFS+ partition wrapped in there, and that I need to do a calculation to set a limit on mount. However, TestDisk isn't giving me the response I expected as can be seen below.

1) On loading up an image with TestDisk I get the following:

Image

2) So, I proceed with a quick scan with the following result:

Image
You can see that the middle partition, the one I'm interested in, is not listed.

3) I proceed with deeper scan and I get:

Image

Image

4) I tried PhotoRec to see if it would recover files (to determine if the drive was encrypted), some files were recovered but as far as I can tell they were unreadable. I don't know what this means (Is PhotoRec trying to build files from encrypted mumbo-jumbo? Is the drive simple half-dead?)

Can anyone think of anything which may be causing this?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Apple Core Storage partition not found on Quick or Deeper Scan

#2 Post by cgrenier »

TestDisk can not (for the moment) recover lost Apple Core Store partition but you don't need to recover a lost partition, so it's not really a problem.
If PhotoRec didn't recover meaningful files, it's probably because the filesystem is encrypted.
Unfortunately I have no solution in this case.

HostileBlue
Posts: 2
Joined: 29 Nov 2021, 16:08

Re: Apple Core Storage partition not found on Quick or Deeper Scan

#3 Post by HostileBlue »

cgrenier wrote: 01 Dec 2021, 18:48 TestDisk can not (for the moment) recover lost Apple Core Store partition but you don't need to recover a lost partition, so it's not really a problem.
If PhotoRec didn't recover meaningful files, it's probably because the filesystem is encrypted.
Unfortunately I have no solution in this case.
I had a feeling this might be the case, I'm going to have to borrow a Mac and try and remember a 10 year old password... or mount it some other way.

Thanks for the reply!

I'll post back if I find a solution.

Locked