Accessing core storage device

Asnyder
Contributor III

Long story short a student came to me saying his computer wasn't working. I open it up and it's booted to the recovery screen. I check diskutil and the HD has been wiped. Send him back to class and dig deeper. He has a flashdrive with three partitions on it: EFI, his name, BOOT OS X. What it looks like to me is he tried to wipe his drive and install his own OS so it wasn't managed. The EFI and BOOT OS X partitions are small and empty as far as I can see. The partition with his name is 7.7Gb out of an 8Gb flashdrive. I can't mount it. I'll post my attempts below. He claims it's encrypted because people would mess with his music and claims that he can't get into the flashdrive but his story doesn't seem straight.
Any Ideas as to what I'm doing wrong or what I can do to view this? I'd love for him to be able to prove to us that he's not lying. I guess my next step if I can't get the partition to mount would be to do a block by block copy which will take time. Excuse all the garbage at the top with me not knowing the proper commands. If i do

diskutil mountdisk /dev/disk2s2

It returned saying that the disk is core storage.

Alexs-MacBook-Pro:~ asnyder$ diskutil list
/dev/disk0 (internal):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                         500.3 GB   disk0
   1:                        EFI EFI                     314.6 MB   disk0s1
   2:                 Apple_APFS Container disk1         499.3 GB   disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +499.3 GB   disk1
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            107.8 GB   disk1s1
   2:                APFS Volume Preboot                 20.2 MB    disk1s2
   3:                APFS Volume Recovery                519.9 MB   disk1s3
   4:                APFS Volume VM                      3.2 GB     disk1s4

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *8.1 GB     disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:          Apple_CoreStorage KALEB                   7.7 GB     disk2s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk2s3

/dev/disk3 (disk image):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     Apple_partition_scheme                        +19.9 MB    disk3
   1:        Apple_partition_map                         32.3 KB    disk3s1
   2:                  Apple_HFS Flash Player            19.9 MB    disk3s2

Alexs-MacBook-Pro:~ asnyder$ diskutil mount /dev/disk2
Volume on disk2 failed to mount; if it has a partitioning scheme, use "diskutil mountDisk"
If the volume is damaged, try the "readOnly" option
Alexs-MacBook-Pro:~ asnyder$ diskutil mountdisk /dev/disk2
Volume(s) mounted successfully
Alexs-MacBook-Pro:~ asnyder$ diskutil mountdisk -readonly /dev/disk2
Usage:   diskutil mountDisk DiskIdentifier|DeviceNode
Attempt to mount the directly-mountable volumes on all of a whole disk's
partitions. However, virtual volumes which are implied by e.g. Core Storage
Physical Volumes, AppleRAID Members, etc. are not handled. If you specify
a partition, then that partition's whole-disk parent is assumed.
Alexs-MacBook-Pro:~ asnyder$ diskutil mount /dev/disk2 -readonly
Usage:   diskutil mount [readOnly] [-mountPoint Path] DiskIdentifier|DeviceNode
Mount will mount the volume in the "standard" place (/Volumes), unless
an optional mount point is specified.
Alexs-MacBook-Pro:~ asnyder$ diskutil mount -readonly /dev/disk2
Usage:   diskutil mount [readOnly] [-mountPoint Path] DiskIdentifier|DeviceNode
Mount will mount the volume in the "standard" place (/Volumes), unless
an optional mount point is specified.
Alexs-MacBook-Pro:~ asnyder$ diskutil mount readonly /dev/disk2
Volume on disk2 failed to mount; if it has a partitioning scheme, use "diskutil mountDisk"
If the volume is damaged, try the "readOnly" option
Alexs-MacBook-Pro:~ asnyder$ diskutil cs
Usage:  diskutil [quiet] coreStorage|CS <verb> <options>
        where <verb> is as follows:

     list                     (Show status of CoreStorage volumes)
     info[rmation]            (Get CoreStorage information by UUID or disk)
     convert                  (Convert a volume into a CoreStorage volume)
     revert                   (Revert a CoreStorage volume to its native type)
     create                   (Create a new CoreStorage logical volume group)
     delete                   (Delete a CoreStorage logical volume group)
     rename                   (Rename a CoreStorage logical volume group)
     createVolume             (Create a new CoreStorage logical volume)
     deleteVolume             (Delete a volume from a logical volume group)
     encryptVolume            (Start encrypting a CoreStorage logical volume)
     decryptVolume            (Start decrypting a CoreStorage logical volume)
     unlockVolume             (Attach/mount a locked CoreStorage logical volume)
     changeVolumePassphrase   (Change a CoreStorage logical volume's passphrase)
     resizeVolume             (Resize a CoreStorage volume)
     resizeDisk               (Resize a CoreStorage physical volume disk)
     resizeStack              (Resize a CoreStorage logical/physical volume set)

diskutil coreStorage <verb> with no options will provide help on that verb

Alexs-MacBook-Pro:~ asnyder$ diskutil cs list
CoreStorage logical volume groups (1 found)
|
+-- Logical Volume Group D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456
    =========================================================
    Name:         KALEB
    Status:       Online
    Size:         7709089792 B (7.7 GB)
    Free Space:   7272878080 B (7.3 GB)
    |
    +-< Physical Volume 08E9ED51-1F42-4966-9C74-865D98827E13
        ----------------------------------------------------
        Index:    0
        Disk:     disk2s2
        Status:   Online
        Size:     7709089792 B (7.7 GB)
Alexs-MacBook-Pro:~ asnyder$ diskutil cs unlock 08E9ED51-1F42-4966-9C74-865D98827E13
diskutil: did not recognize coreStorage verb "unlock"; type "diskutil coreStorage" for a list
Alexs-MacBook-Pro:~ asnyder$ diskutil cs unlockvolume 08E9ED51-1F42-4966-9C74-865D98827E13
08E9ED51-1F42-4966-9C74-865D98827E13 is not a CoreStorage Logical Volume UUID
Alexs-MacBook-Pro:~ asnyder$ diskutil cs unlockvolume D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456
D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456 is not a CoreStorage Logical Volume UUID
Alexs-MacBook-Pro:~ asnyder$ diskutil cs revert D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456
The given UUID is a not a valid CoreStorage Logical Volume UUID
Alexs-MacBook-Pro:~ asnyder$ diskutil cs revert 08E9ED51-1F42-4966-9C74-865D98827E13
The given UUID is a CoreStorage Physical Volume UUID; please specify a Core Storage Logical Volume UUID instead
Alexs-MacBook-Pro:~ asnyder$ diskutil cs info /dev/disk2
/dev/disk2 is not a CoreStorage disk
Alexs-MacBook-Pro:~ asnyder$ diskutil cs info /dev/disk2s2
Core Storage Properties:
   Role:                       Physical Volume (PV)
   UUID:                       08E9ED51-1F42-4966-9C74-865D98827E13
   Parent LVG UUID:            D2E9F8B3-7CFA-4AEE-BBBE-26E6767E1456
   Device Identifier:          disk2s2
   PV Size:                    7709089792 B
   PV Status:                  Online
Alexs-MacBook-Pro:~ asnyder$ diskutil cs unlockvolume /dev/disk2s2
/dev/disk2s2 is not a CoreStorage Logical Volume UUID
Alexs-MacBook-Pro:~ asnyder$
0 REPLIES 0