So I restored this .img image to a physical disk and connect it to my macOS VM. Here are some more observations:
- Using diskutil list in command line I can see the drive connected with three volumes
- I can see the drive in MacQuisition
- still cannot mount the disk using Disk Utility GUI
- still cannot mount the disk using Disk Utility in command line
Interestingly, when I tried imaging the perceived 'encrypted' volume, MacQuisition didn't appear to recognise it to be encrypted and just went on to start imaging it - please correct if I'm wrong, I thought MacQuisition would normally detect a FileVault2 encryption and give you a chance to enter password & recovery for it?
Through these observations I'm now considering a different hypothesis; is it possible that this is an image of a reset system, where nothing - including disk encryption - has been initiated (since the 'Recovery HD' partition is only created at the activation of disk encryption?)
↧