The macOS operating system has the following disk management systems:

FileVault , is a disk encrypted utility;

Fusion Drive is an Apple's hybrid drive technology;

CoreStorage is a logical volume management system.

 

R‑Studio supports all these technologies and can unlock their encrypted volumes (drives and images) using either their passwords or recovery keys.

CoreStorage/FileVault

To unlock the volume

 

If the volume is partially encrypted, R‑Studio can recognize which part is encrypted and which isn't. It will  provide a correct access to the unencrypted and encrypted parts of the volume, provided that the correct password is entered.

 

R-Studio Technician/T80+

In addition to the password, it’s possible to enter other decryption data. Click the Advanced… button and enter available data.

This data is usually very hard to obtain and only very advanced institutions can recover it from actual hardware.

 

Data recovery from deleted or damaged APFS volumes

When macos deletes an APFS volumes, it also wipes out all decryption information from its APFS container. In this case even knowing the password won’t help. Still, there’s a trick that may help to open a deleted or damaged encrypted volume.

Let’s us have a hard drive with an APFS container with 3 APFS volumes:

One of them has been deleted and R‑Studio cannot unlock (decrypt) it:

But if we have an image of the disk’s previous state, we can extract the necessary encryption information from that image.

Load the image and double-click the existing volume. Click the Advanced… button instead of entering its password.

 

Click the Export crypto context... button and save a file with this information. Then click the Close Image button to unload the image.

Then double-click the APFS-1 volume and click the Advanced button.

 

Click the Load and apply crypto context… button

and load the file generated from the image.

 

Select the required information type (a password for our case), enter the data, and click the Unlock button.

 

Note that the password will be explicitly shown.

 

R‑Studio will open files on the volume.

Apple Fusion Drive

R‑Studio detects components of Apple Fusion Drive and creates virtual Fusion Drives automatically. At the same time, R‑Studio gives access to the individual components of the Fusion Drives (drives and images).

When an automatically created Fusion Drive  is selected, R‑Studio highlights its components.

R‑Studio shows the components of the Fusion Drive on its APFS Fusion Components tab.

R‑Studio shows broken Fusion Drive s in pink.

The Fusion Drive Components tab also allows you to manually disconnect or connect the components, for example, if they are such damaged that R‑Studio cannot recognize them as parts of a broken Fusion Drive. Select the object from the drop-down box and click the Connect button. R‑Studio displays the objects it recognizes as the components of the Fusion Drive in blue.

You may immediately switch to the Fusion Drive configuration that R‑Studio believes most probable by clicking the Reassemble button.

R‑Studio shows Fusion Drive with manually added components in blue: