Recovering data and the Macintosh HD - Data volume

[indigit4l]

I've worked on Mac laptops and desktops for nearly 15 years (as much as one can these days!). I've now had this one thing happen to me three times now in as many weeks. Here it is:

The computer will not boot so I have a bootable copy of Catalina I can run off of a flash drive. For years I can boot from that (or older version), browse to their drive and then save their files. If the drive is encrypted, I just have to enter their password and the drive is available. Now though, I'm getting one volume that is labeled Update (Visible in Finder and with nothing of value on it, of course) and the other is Macintosh HD - Data, which is not mounted. When I go to mount it, it shows up with the user account selection (see picture) and even gives me the password hint with the actual hint. Except the password never works. Everytime the person is positive of the password, and this time the individual even gave me the FileVault password and the login password. I trust it's the right password because this keeps happening for me, the exact same way. I tried both passwords many times and nothing is helping.

Either I am missing something or this is a strange side effect of the update crash. Since the other APFS volume is a system volume, maybe somehow it's necessary to unlock the Data partition, but it can't because it's marked Update and has different contents right now?

Googling hasn't helped at all for me, and I understand why as you won't see this kind of thing unless you work Macs that have this kind of failure routinely. Any help would be appreciated. I hope I am missing something simple because I don't want people not to be able to get their data back!

 

[ferrarr]

In Disk Utility, make sure you have selected to show all devices in the View menu.

Because macOS has been locked down so much, you may need to give permission in System Preferences > Security & Privacy. But I'm not sure if that's even possible on a bootable USB installer?

 

[indigit4l]

Thank you ferrarr. Duh, that sounds a bit promising; I will try that. And it's a bootable Catalina USB, not just the installer - which you probably meant, just making sure in case that's helpful. It should be something to try since it is the full OS. And also, his Mac is/was running Big Sur, and so were the others.

Since the other task is to replace the internal HD with an SSD, I'm going to go ahead and do that. And circle back to the data, since I can always just plug in the old drive with an adapter. I'll post if that does or doesn't help, for sure.

 

[MacInWin]

I would bet that when you change the view to "Show All Devices" another Volume will show up. Probably named Macintosh HD. And I would also venture to say that the system installed on the Mac is Big Sur. What Apple changed in Big Sur from Catalina was that it increased security on the Macintosh HD Volume and also encrypted it so that only the system can read/write to it. Catalina knows nothing of that, so it won't even mount the Volume in the Container. It *may not* even show it, but I'm betting it will, but it will be greyed out and unavailable to you with any tool or password. The encryption on the Macintosh HD is not the FileVault, as now FileVault only applies to Macintosh HD - Data Volume. So the customer can give you nothing to unlock that Macintosh HD volume. It's all up to Apple.

As for the not booting issue, why not boot into Recovery Mode and reinstall the OS? That should work, and also should leave the original user data intact. I'd make a backup, of course, as anything can go wrong, but a reinstall over the un-bootable data should work just fine.