SOLVED: Reading encrypted Mac OS hard drive

bosco · 2021-06-18 20:36:03

My old Mac Book Pro died after several years of usage, I put the SDD on a USB enclosure to retrieve the files on my current laptop ( ThinkPad t480 running arch). If I mount it, file managers and the ls command show it as empty, the file format is Mac OS Extended (Case-sensitive, Journaled, Encrypted), is there any software I can use to see the contents?

Last edited by bosco (2021-06-19 20:57:27)

Slithery · 2021-06-18 20:44:14

A quick web search for 'encrypted HFS linux' seems to conclude that it's not possible, I only looked at the first few results though and those were quite old.

bosco · 2021-06-18 20:47:43

Slithery wrote:

A quick web search for 'encrypted HFS linux' seems to conclude that it's not possible, I only looked at the first few results though.

Yes, I saw a stack overflow post saying something like that though there were some projects trying to achieve it, was hoping for better luck now .
I'm guessing my best option is to run a Mac OS VM in qemu

seth · 2021-06-18 20:57:02

You could try https://aur.archlinux.org/packages/ufsd-module-dkms/

bosco · 2021-06-19 17:02:24

seth wrote:

You could try https://aur.archlinux.org/packages/ufsd-module-dkms/

That just made everything worse

Mounting didn't work with the command so I figured I'll reboot, that happened. Luckily I found my installation media, so I chrooted to pacman -R that package, reboot and I'm still seeing this screen

Last edited by bosco (2021-06-19 17:05:13)

seth · 2021-06-19 17:11:01

That's hardly the outfall of installing a kernel module.
The package drags in the lts kernel (for probably no reason) and that is what you're now failing to try to boot. ext4 is unknown what means it's for some reason not in the initramfs, but the fallback image (for the lts kernel) should(tm) still boot. Likewise the other kernel you were probably booting previously.

progandy · 2021-06-19 17:24:36

After a cursory search. decryption of "Encrypted HFS+" (as far as I understand that is HFS+ inside FileVault LVM) may be possible with libfvde: https://github.com/libyal/libfvde
Afterwards maybe the kernel-internal hfsplus driver might be enough.
If the kernel driver does not work, maybe this alternative fuse driver will: https://github.com/0x09/hfsfuse (source)

If it is an APFS volume, you'll need the paragon driver for apfs, or one of these experimental drivers:
https://github.com/sgan81/apfs-fuse
https://github.com/linux-apfs/linux-apfs-rw
Only the paragon as well as apfs-fuse driver support decryption of the apfs encryption method, though. (T2 chip encrypted volumes not supported, even if you have the recovery key. There is some special stuff happening that the dev has not figured out)

Last edited by progandy (2021-06-19 17:42:51)

bosco · 2021-06-19 20:57:08

seth wrote:

That's hardly the outfall of installing a kernel module.
The package drags in the lts kernel (for probably no reason) and that is what you're now failing to try to boot. ext4 is unknown what means it's for some reason not in the initramfs, but the fallback image (for the lts kernel) should(tm) still boot. Likewise the other kernel you were probably booting previously.

Sorry, it was wrong of me to assume that, managed to get back on my system by installing GRUB on my EFI partition from the arch installation media, been using rEFInd up until now.

progandy wrote:

After a cursory search. decryption of "Encrypted HFS+" (as far as I understand that is HFS+ inside FileVault LVM) may be possible with libfvde: https://github.com/libyal/libfvde
Afterwards maybe the kernel-internal hfsplus driver might be enough.
If the kernel driver does not work, maybe this alternative fuse driver will: https://github.com/0x09/hfsfuse (source)
If it is an APFS volume, you'll need the paragon driver for apfs, or one of these experimental drivers:
https://github.com/sgan81/apfs-fuse (etc)

Went for libfvde + apfs-fuse, managed to access my drive and opened some files to make sure it worked, and it did, thank you!

Arch Linux

#1 2021-06-18 20:36:03

SOLVED: Reading encrypted Mac OS hard drive

#2 2021-06-18 20:44:14

Re: SOLVED: Reading encrypted Mac OS hard drive

#3 2021-06-18 20:47:43

Re: SOLVED: Reading encrypted Mac OS hard drive

#4 2021-06-18 20:57:02

Re: SOLVED: Reading encrypted Mac OS hard drive

#5 2021-06-19 17:02:24

Re: SOLVED: Reading encrypted Mac OS hard drive

#6 2021-06-19 17:11:01

Re: SOLVED: Reading encrypted Mac OS hard drive

#7 2021-06-19 17:24:36

Re: SOLVED: Reading encrypted Mac OS hard drive

#8 2021-06-19 20:57:08

Re: SOLVED: Reading encrypted Mac OS hard drive

Board footer