storage – Encrpyted APFS + replace motherboard means data lost?

Spread the love

So in the end I managed to get it back when the owner remembered their password!

I had suspected that Apple was using a hardware-based salt for the encryption to prevent taking the drive out and brute forcing it. I had read on at least one page on the Apple website, that they do this. In fact, it was the owner that didn’t remember their password for a while as they hadn’t used the machine for quite some time.

So, in conclusion, it was possible to mount the drive using an OSX bootable USB drive and extract the data. Then after installing fresh without OSX, due to the motherboard firmware not supporting APFS booting, it eventually updated itself and flashed the firmware.

It wasn’t possible to flash the firmware from the USB stick by upgrading OSX there, because the firmware update needs to be on an internal drive.

It was quite a time-consuming and arduous process though, so I’m putting this here in the hopes of helping someone else who replaces their motherboard and finds that their machine suddenly doesn’t boot.

Author: Dhanraj7978

Leave a Reply

Your email address will not be published. Required fields are marked *