[GUIDE] Recover Files From Corrupt FireVault 2 Drive

[jimmyco2008]

When I had this problem today, Google wasn't much help. Thread after thread with this problem and no solution, except of course to wipe the drive.

Files are important, especially your files, right? 

 

Background

 

I was running OS X 10.10 Yosemite, and was attempting to rid of a Bootcamp partition I set up on my Macbook's SSD. Disk Utility said no, and I figured the problem would be fixed with a disk repair, since I got the same error when trying to create the bootcamp partition. To do this properly, the disk (internal SSD) can't be in use, so I put it in Target Disk Mode and plugged it into my Mac Mini.

 

I of course have FireVault 2 enabled, and so it asks for the password every time I use TDM. I go to Disk Utility on the Mac Mini and begin the Repair Disk operation for the Macbook's SSD. It fails. Not only that, but it fails to remount the partition. So I unplug it and plug it back in. It asks for the password. I give it the password. No dice. Just hangs. 

 

So I started panicking, I shut off the Macbook, tried to boot it normally. It wouldn't actually do anything, just sit on a black screen (Yosemite replaces the white/light gray background with black). So I rebooted again, this time holding the alt key. It brought up my Macbook's SSD. I selected it, and it started booting. Phew. It asked for my password right off the bat of course, because it's FireVault, and it took it and started booting.

 

But then it got stuck about 40% of the way through the loading bar (Yosemite also has a loading bar instead of s spinning circle). I tried booting a few times this way, kept getting stuck. Let it sit for a while. Nothing. So at this point I was freaking out. It seemed there was no way to access the files on this drive. I resorted to Googling the problem, but found nothing, aside from how to format my SSD and reinstall OS X. Like I said, though, files are important, so that wasn't an option...

 

The Magic

 

So in order to recover your files from your FileVault 2 SSD, first you must ensure that you are in the same position I'm in. You tried repairing, didn't work. You can hold alt at boot and actually get to enter your password, and OS X does start to boot. If you can't get that far, because that unlocks FileVault, then you may be out of luck. 

 

Otherwise, great! Let's get to work. What we'll be doing is booting OS X into Single-User Mode (Safe Mode + Verbose if you will), and using bash (gasp!), which you may also know as "Terminal", to access the precious files, mount a USB flash drive, and copy said files to said flash drive.

 

Make sure you have a flash drive of decent size. Ideally it's large enough to fit all your files onto it. Otherwise, if you're like me and all you have is a lowly 16GB drive laying around, that'll still work, you'll just have to make multiple "trips" if you will between your Macbook and the device (hopefully another Mac) you're unloading all these files onto. For clarification, if your flash drive is NOT large enough for all your files, you should have another Mac around that can take the files from the flash drive, so you can repurpose the flash drive for receiving new files from the corrupt drive.

 

Also, you'll want to make sure that there aren't any external drives plugged into the problem-child Mac. This complicates things down the line.

 

So anyway, with the Mac off, power it on, and immediately hold alt. Once you're at the "boot drive selection screen", hold command + s and while holding those two, hit enter. In a sec it'll ask for that FileVault password. Go for it, and then you'll see a light show of text, and a cursor at the bottom. 

 

Type in 

/sbin/mount -uw /

to cancel the automatic shutdown of Single-User Mode and to mount the Mac's HD/SSD.

 

Insert that flash drive, making sure that it's formatted as HFS+ (Mac OS Extended, Journaled).

 

Type in 

hdiutil mount /dev/disk2s2

to mount the flash drive, which 99% of the time will be disk2s2, though if you get an error it probably isn't. Look at the disk in Disk Utility on a functional Mac to verify that the HFS+ part of the flash drive is in fact s2. Also, if you have a Mac Mini Server, or really any Mac with more than one internal HD/SSD, it may actually be disk3. So try disk3s2 if disk2s2 doesn't work.

 

Next, we'll want to make a mount point for the flash drive on the Mac's internal HD/SSD.

mkdir /Volumes/flashdrive

You can replace "flashdrive" what whatever you damn-well please, but do remember what you decide to name it.

 

Okay, so we didn't really mount the flash drive earlier, that was more so you didn't have to type in this longer command multiple times while trying to figure out if the flash drive is disk2 or disk3, etc.

/sbin/mount_hfs /dev/disk2s2 /Volumes/flashdrive

Of course replace disk2s2 with whatever you figured out your flash drive is, though again, for most people it should be disk2s2.

Note: if you eject this flash drive improperly (just pulling it out), upon reinsertion, it will take the next available disk number. So if it was disk2s2, now it's disk3s2. +1 for every time you do this. It's taking me so many trips to back up all my stuff I'm up to disk5s2, so don't feel too bad if you don't feel like ejecting properly. 

 

If you do feel the need to eject properly, here's the command to do so:

hdiutil eject /dev/disk2s2

Though as long as you're sure there are no file transfers in progress, you're pretty much clear to remove the flash drive improperly. If that white block/cursor is preceded by "bash-3.2#" (or something similar), the transfer is complete. Keep that in the back of your head.

 

So actually copying the files. Ideally, you know what files you need to back up, and you know where they are. Here's an example snippet for copying your Documents folder to the flash drive:

cp -r /Users/you/Documents /Volumes/flashdrive

Now there are multiple "copy" commands we can use, I went with cp because that's the first one I found in Google. The -r is important because it tells cp to copy all files AND folders (a.k.a. directories) in your specified path. So without the -r, the above command wouldn't copy squat. You could tack on a * at the end of that (../Documents*) to copy all files in Documents, but it would still skip the directories (folders). The more you know.

 

Anyway, if you have a large enough flash drive, you can backup your entire home folder with:

cp -r /Users/you /Volumes/flashdrive

Woo!

 

 

Afterthoughts

 

- If you don't know exactly where thinks are, use the ls command. For example, ls / will list all the folders (directories) in the root of the Mac's HD/SSD. You can work from there. For example, you might not recall where exactly this important file is, but you can use ls /Users/you/Desktop and ls /Users/you/Downloads to see if it's in your Documents folder or your Downloads folder.

 

-Remember, hidden folders and files are preceded by a period (ie, .localized), and files have their extensions affixed to them (ie, file.txt). Otherwise, it's a folder!

 

- To navigate to folders with names that have spaces (ie, "iTunes Media"), put a \ in between the last letter of the first word and the space itself to look like so:

../Music/iTunes\ Media

- File transfers take considerably longer than if you were using a perfectly-functional Mac. Be patient. Ideally, you have a flash drive like a SanDisk Cruzer that flashes incessantly when it's transferring files. That should keep you content while you nervously wait for the first batch of files to backup.

 

-Make sure you backed up EVERYTHING that you need before formatting that pesky HD/SSD with the Recovery partition or an OS X USB Installer or Single-User Mode if you like it so much.

 

- When setting up OS X all over again on the Mac, really, really think before enabling FileVault 2 again. Remember, if not for FileVault, you wouldn't even have been in this mess. 

[Allan]

Thank you for this!

Is a good reminder to those who work where they should not. 

[mendietinha]

sadly i lock myself out of yosemite appearing still waiting for root device. on my hack.

[jimmyco2008]

sadly i lock myself out of yosemite appearing still waiting for root device. on my hack.

 

Unfortunately I wrote this guide using my real MacBook Pro, so it's tough for me to help you, there.

 

You might try plugging the hard drive for your hackintosh into a legit Mac, and booting from it. Then you should be able to follow this guide.

[mendietinha]

thanks but no need for it. i already erase the yosemite partition. there were no important info there.

[evoheyax]

One suggestion that I hope can help.

 

What I did to recover from a 11 o clock at night and not using my brain mistake was to boot an external ssd through esata (as I have a laptop). I have an old ssd with mountain lion and that is in an enclosure with an esata bus (or usb 2.0 if you don't have esata), and was able to recover from that.

 

I used the [url="http://www.insanelymac.com/forum/topic/279450-why-insanelymac-does-not-support-tonymacx86/"]#####[/url] method to install os x, so I did the following:

 

1. Boot from [url="http://www.insanelymac.com/forum/topic/279450-why-insanelymac-does-not-support-tonymacx86/"]#####[/url] flashdrive

2. When at bootloader, select the external ssd's operating system (should be some version of os x)

3. When in, go to finder, and right click on the internal hard drive (or your main hard drive), and select the 'remove encryption' option.

4. Enter password of the firevault (the password of the account you used to turn firevault on with) when asked.

5. Shutdown and Boot with [url="http://www.insanelymac.com/forum/topic/279450-why-insanelymac-does-not-support-tonymacx86/"]#####[/url] again, and now you will see the internal hard drive into 2 partitions, one which will look like your normal boot partion and one which will said 'raid' underneath.

6. Boot the partition that DOES NOT say raid (ie the normal looking one)

7. And your back in like normal.

 

I've yet to figure out the process of recovering completly so that I don't need to boot from a [url="http://www.insanelymac.com/forum/topic/279450-why-insanelymac-does-not-support-tonymacx86/"]#####[/url] flashdrive everytime (as tis happened last night nad i only had a few minutes to figure this bit out), but most likely, that can be fixed by repairing the selected boot partition through comman line.

 

Hope that this helps someone. Please note this may not work for all installs. It depends on what method you've used to install os x.