MBP encrypted disk, disk password is unknown.


Rendering Error in layout Widget/Social: Call to a member function exists() on null. Please enable debug mode for more information.
  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5901 by saddad
My son ended his beautiful life. His passion was computers. would be great if he left some memories on his MBP, 2013 retina. apple unlocked something thy said but would not or could not change the disk password. The most impotrant issue is to preserve the personality of this machine. let's proceed carefully.
unable to boot into SU, no disk listed in password reset, tried many passwords. it's locked up good, did i mention disk encription. forever grateful for the craft

Freedom

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago #5902 by reverendalc
sorrowed are the circumstances.

unfortunately, if the disk is encrypted, i don't believe anybody on this forum to be powerful enough to break that encryption.

you mention you cannot boot single-user. is that because there's a firmware password as well? if you boot with ALT, or CMD-R, are you greeted with the padlock screen?

Please Log in or Create an account to join the conversation.

  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5913 by saddad
Bootup with alt-cmmd-r is not padlock.
spinning planet earth asking for wifi network, ours not listed. can't type ours in
dont think there is a firmware pass, just user screen password

Freedom

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago #5914 by reverendalc
i don't imagine you have an external enclosure you can connect the ssd to another mac with?

Please Log in or Create an account to join the conversation.

  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5915 by saddad
have two pc laptops, gaming pc linux/ubuntu.
i will buy an apple enclosure if it is the next logical attempt.
is the ssd difficult to remove? and will doing so remove the personality.

Freedom

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago #5916 by reverendalc
the ssd is quite simple to remove. simply remove the bottom lid, and a single screw will release the ssd. it's a blade type. the hardest part will likely be having the correct driver!

eshop.macsales.com/item/OWC/MAU3ENPRPCI/

that's a quality enclosure which should work fine with the drive. you may likely find a cheaper alternative if you dig around.

you are certain the drive itself is encrypted? have you booted with USB install media and checked the drive with disk utility?
also, forgive me for asking what may be incredibly obvious to you, but are you attempting to boot single-user-mode correctly?

you keep mentioning the "personality" of this mac. if you are referring to keeping your son's data intact and in place, just don't do anything crazy and you'll be fine.
The following user(s) said Thank You: saddad

Please Log in or Create an account to join the conversation.

  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5917 by saddad
single-user and verbose no go (cmnd-s) (cmnd-v).. found one way to get to white text/code. on startup hold down cmnd-s and cmnd-r. goes to terminal -sh-3.2#
what to code?

Freedom

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago #5918 by reverendalc
can you upload a screenshot? cmd-s sounds like single-user, but cmd-r should boot recovery partition. it's possible to also boot recovery partition and load terminal from there, although it's not quite the same access point.

could you please elaborate on your way to get to "white text/code"?

once i have a better idea where you're at, i'll know where to go

Please Log in or Create an account to join the conversation.

  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5923 by saddad
to get to this screen the cmd-s and cmd-r are held down at power up.
tried to do the applesetupdone coding but get timed out or will say file not found

Freedom
Attachments:

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago #5924 by reverendalc
so you're holding CMD+R+S to get there? that's interesting.
that's where you want to be though

type:
cd /
ls

share results

Please Log in or Create an account to join the conversation.

  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5925 by saddad
cd/ = no such file or directory
ls =
.DS store System sbin
.Trashes Volumes tmp
.vol bin usr
Applications dev var
Install OS X El Capitan.app etc
Library private

Freedom

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago #5926 by reverendalc
command line is very sensitive to capitalization, spaces, and syntax in general.

the command is cd(space)/

so it looks like you've launched the recovery console in single-user mode.

give me a "diskutil list"

Please Log in or Create an account to join the conversation.

  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5927 by saddad
diskutil
Unable to run because unable to use the DiskManagement framework.
Common reasons include. the DiskArbitration framework being unavailable due to booting single-user mode

Freedom

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago - 7 years 3 months ago #5928 by reverendalc
oh right, how thoughtless of me.
fsck -fy
mount -uw /
ls -l /dev/disk*

please share results

we are looking for the primary disk (ssd). if the MacBook has 128gb storage, it should be identifiable by that value
the results will be listed in the diskXsY where X is the chronological order of the disks and Y is the order of partitions

our ultimate goal is to attempt to mount the internal storage. this will be the ultimate test if the disk is encrypted, and whether or not we can proceed.
Last edit: 7 years 3 months ago by reverendalc.

Please Log in or Create an account to join the conversation.

  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5929 by saddad
fsck -fy
** OS X Base system appears to be OK

mount -uw /
disk1s1: device is write locked

now terminal is mad

Freedom

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago #5930 by reverendalc
if you still have access to the command prompt, try the ls /dev/ command.

if it's locked up, reboot the computer and re-enter su mode

the prognosis is grim

Please Log in or Create an account to join the conversation.

  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5931 by saddad
exit = lots of code down to fInterfacesnapshots is missing then locked terminal

Freedom

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago #5932 by reverendalc
well, disk encryption is beyond the scope of my abilities. apple's lockdown is pretty darn tight.

as daunting a task as it seems, guessing the password is likely the most realistic and affordable means to gaining file access.

you could attempt a brute force attack, which could take years/decades/centuries.

you could order a replacement ssd with enclosure from OWC, and get the MacBook up and running and simply keep the original ssd in the enclosure while you attempt other means of data extraction, but i'm not familiar with any successful decryption methods or anecdotes.
The following user(s) said Thank You: saddad

Please Log in or Create an account to join the conversation.

  • saddad
  • saddad's Avatar Topic Author
  • Offline
  • Script Kiddy
  • Script Kiddy
  • we are given today and never promised tomorrow
More
7 years 3 months ago #5933 by saddad
let's not give up, i agree with your thoughts on encription.

this hack, like grief, has no timetable.

you have been so helpful and i can't thank you enough.
effort and time will help


the trouble is, we think there is time


we lost a good person

your worst enemy can't harm you as much as your own unguarded thoughts....

Freedom
Attachments:

Please Log in or Create an account to join the conversation.

More
7 years 3 months ago #5934 by reverendalc
at the risk of sounding inconsiderate:

perhaps you find consolation in the fact that grief is conquered in stages, meanwhile this encrypted disk will be a journey the lengths of which remain unknown.

if it's not too great an imposition, i would suggest obtaining an external enclosure. i will root around and see if i can find a means of running a brute force or dictionary attack.

in the meantime, if you have access to email or other personal effects, perhaps you may find some insight into the passwords he preferred. i have only a few passwords which i use for all services, perhaps he was likeminded.

Please Log in or Create an account to join the conversation.

Who's Online

We have 456 guests and no members online

N00BZ

  • ljamal
  • ljamal74
  • mikeg2atest
  • ducchinhbui
  • anjarezt

Cookies