Posted on 10-10-2017 01:47 PM
Long story short a student came to me saying his computer wasn't working. I open it up and it's booted to the recovery screen. I check diskutil and the HD has been wiped. Send him back to class and dig deeper. He has a flashdrive with three partitions on it: EFI, his name, BOOT OS X. What it looks like to me is he tried to wipe his drive and install his own OS so it wasn't managed. The EFI and BOOT OS X partitions are small and empty as far as I can see. The partition with his name is 7.7Gb out of an 8Gb flashdrive. I can't mount it. I'll post my attempts below. He claims it's encrypted because people would mess with his music and claims that he can't get into the flashdrive but his story doesn't seem straight.
Any Ideas as to what I'm doing wrong or what I can do to view this? I'd love for him to be able to prove to us that he's not lying. I guess my next step if I can't get the partition to mount would be to do a block by block copy which will take time. Excuse all the garbage at the top with me not knowing the proper commands. If i do
diskutil mountdisk /dev/disk2s2
It returned saying that the disk is core storage.
Alexs-MacBook-Pro:~ asnyder$ diskutil list
/dev/disk0 (internal):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme 500.3 GB disk0
1: EFI EFI 314.6 MB disk0s1
2: Apple_APFS Container disk1 499.3 GB disk0s2
/dev/disk1 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +499.3 GB disk1
Physical Store disk0s2
1: APFS Volume Macintosh HD 107.8 GB disk1s1
2: APFS Volume Preboot 20.2 MB disk1s2
3: APFS Volume Recovery 519.9 MB disk1s3
4: APFS Volume VM 3.2 GB disk1s4
/dev/disk2 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *8.1 GB disk2
1: EFI EFI 209.7 MB disk2s1
2: Apple_CoreStorage KALEB 7.7 GB disk2s2
3: Apple_Boot Boot OS X 134.2 MB disk2s3
/dev/disk3 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: Apple_partition_scheme +19.9 MB disk3
1: Apple_partition_map 32.3 KB disk3s1
2: Apple_HFS Flash Player 19.9 MB disk3s2
Alexs-MacBook-Pro:~ asnyder$ diskutil mount /dev/disk2
Volume on disk2 failed to mount; if it has a partitioning scheme, use "diskutil mountDisk"
If the volume is damaged, try the "readOnly" option
Alexs-MacBook-Pro:~ asnyder$ diskutil mountdisk /dev/disk2
Volume(s) mounted successfully
Alexs-MacBook-Pro:~ asnyder$ diskutil mountdisk -readonly /dev/disk2
Usage: diskutil mountDisk DiskIdentifier|DeviceNode
Attempt to mount the directly-mountable volumes on all of a whole disk's
partitions. However, virtual volumes which are implied by e.g. Core Storage
Physical Volumes, AppleRAID Members, etc. are not handled. If you specify
a partition, then that partition's whole-disk parent is assumed.
Alexs-MacBook-Pro:~ asnyder$ diskutil mount /dev/disk2 -readonly
Usage: diskutil mount [readOnly] [-mountPoint Path] DiskIdentifier|DeviceNode
Mount will mount the volume in the "standard" place (/Volumes), unless
an optional mount point is specified.
Alexs-MacBook-Pro:~ asnyder$ diskutil mount -readonly /dev/disk2
Usage: diskutil mount [readOnly] [-mountPoint Path] DiskIdentifier|DeviceNode
Mount will mount the volume in the "standard" place (/Volumes), unless
an optional mount point is specified.
Alexs-MacBook-Pro:~ asnyder$ diskutil mount readonly /dev/disk2
Volume on disk2 failed to mount; if it has a partitioning scheme, use "diskutil mountDisk"
If the volume is damaged, try the "readOnly" option
Alexs-MacBook-Pro:~ asnyder$ diskutil cs
Usage: diskutil [quiet] coreStorage|CS <verb> <options>
where <verb> is as follows:
list (Show status of CoreStorage volumes)
info[rmation] (Get CoreStorage information by UUID or disk)
convert (Convert a volume into a CoreStorage volume)
revert (Revert a CoreStorage volume to its native type)
create (Create a new CoreStorage logical volume group)
delete (Delete a CoreStorage logical volume group)
rename (Rename a CoreStorage logical volume group)
createVolume (Create a new CoreStorage logical volume)
deleteVolume (Delete a volume from a logical volume group)
encryptVolume (Start encrypting a CoreStorage logical volume)
decryptVolume (Start decrypting a CoreStorage logical volume)
unlockVolume (Attach/mount a locked CoreStorage logical volume)
changeVolumePassphrase (Change a CoreStorage logical volume's passphrase)
resizeVolume (Resize a CoreStorage volume)
resizeDisk (Resize a CoreStorage physical volume disk)
resizeStack (Resize a CoreStorage logical/physical volume set)
diskutil coreStorage <verb> with no options will provide help on that verb
Alexs-MacBook-Pro:~ asnyder$ diskutil cs list
CoreStorage logical volume groups (1 found)
|
+-- Logical Volume Group D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456
=========================================================
Name: KALEB
Status: Online
Size: 7709089792 B (7.7 GB)
Free Space: 7272878080 B (7.3 GB)
|
+-< Physical Volume 08E9ED51-1F42-4966-9C74-865D98827E13
----------------------------------------------------
Index: 0
Disk: disk2s2
Status: Online
Size: 7709089792 B (7.7 GB)
Alexs-MacBook-Pro:~ asnyder$ diskutil cs unlock 08E9ED51-1F42-4966-9C74-865D98827E13
diskutil: did not recognize coreStorage verb "unlock"; type "diskutil coreStorage" for a list
Alexs-MacBook-Pro:~ asnyder$ diskutil cs unlockvolume 08E9ED51-1F42-4966-9C74-865D98827E13
08E9ED51-1F42-4966-9C74-865D98827E13 is not a CoreStorage Logical Volume UUID
Alexs-MacBook-Pro:~ asnyder$ diskutil cs unlockvolume D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456
D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456 is not a CoreStorage Logical Volume UUID
Alexs-MacBook-Pro:~ asnyder$ diskutil cs revert D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456
The given UUID is a not a valid CoreStorage Logical Volume UUID
Alexs-MacBook-Pro:~ asnyder$ diskutil cs revert 08E9ED51-1F42-4966-9C74-865D98827E13
The given UUID is a CoreStorage Physical Volume UUID; please specify a Core Storage Logical Volume UUID instead
Alexs-MacBook-Pro:~ asnyder$ diskutil cs info /dev/disk2
/dev/disk2 is not a CoreStorage disk
Alexs-MacBook-Pro:~ asnyder$ diskutil cs info /dev/disk2s2
Core Storage Properties:
Role: Physical Volume (PV)
UUID: 08E9ED51-1F42-4966-9C74-865D98827E13
Parent LVG UUID: D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456
Device Identifier: disk2s2
PV Size: 7709089792 B
PV Status: Online
Alexs-MacBook-Pro:~ asnyder$ diskutil cs unlockvolume /dev/disk2s2
/dev/disk2s2 is not a CoreStorage Logical Volume UUID
Alexs-MacBook-Pro:~ asnyder$