No cryptographic users for APFS Volume

[Massaguana]

Hello,

i wood like to know if drat can help me with an APFS Crypted Volume that is broken. The Crytouser is gone...

Here are some information out of diskutil apfs, drat an other tools for you

diskutil apfs list
+-- Container disk7 9C132A77-662D-4CD3-A31C-EB6114D2E486
    ====================================================
    APFS Container Reference:     disk7
    Size (Capacity Ceiling):      4000577273856 B (4.0 TB)
    Capacity In Use By Volumes:   1856282431488 B (1.9 TB) (46.4% used)
    Capacity Not Allocated:       2144294842368 B (2.1 TB) (53.6% free)
    |
    +-< Physical Store disk2s2 957CBC86-013B-4194-8A3E-B59C6264183C
    |   -----------------------------------------------------------
    |   APFS Physical Store Disk:   disk2s2
    |   Size:                       4000577273856 B (4.0 TB)
    |
    +-> Volume disk7s1 731511E0-5B27-3286-81B7-291C87B2E388
        ---------------------------------------------------
        APFS Volume Disk (Role):   disk7s1 (No specific role)
        Name:                      Macintosh HD 2 (Case-insensitive)
        Mount Point:               Not Mounted
        Capacity Consumed:         1855796637696 B (1.9 TB)
        FileVault:                 Yes (Locked)

diskutil apfs unlockVolume disk7s1
Passphrase:
Unlocking any cryptographic user on APFS Volume disk7s1
Passphrase incorrect or user does not exist

diskutil apfs listUsers disk7s1
No cryptographic users for disk7s1

diskutil verifyVolume /dev/disk7s1
Started file system verification on disk7s1 Macintosh HD 2
Verifying file system
Volume is already unmounted
Performing fsck_apfs -n -x /dev/rdisk7s1
Checking the container superblock
warning: container has been mounted by APFS version 1934.101.3, which is newer than 1412.141.3
warning: disabling overallocation repairs by default; use -o to override
Checking the EFI jumpstart record
Checking the space manager
Checking the space manager free queue trees
Checking the object map
Checking volume
Checking the APFS volume superblock
The volume Macintosh HD 2 was formatted by hfs_convert (748.77.8) and last modified by apfs_kext (1934.101.3)
Checking the object map
Checking the snapshot metadata tree
Checking the snapshot metadata
Checking the extent ref tree
error: (oid 0x4a5b4a4) apfs_extentref: btn: found zeroed-out block
Extent ref tree is invalid
The volume /dev/rdisk7s1 could not be verified completely
File system check exit code is 0
Restoring the original state found as unmounted
Finished file system verification on disk7s1 Macintosh HD 2

sudo ./drat-0.1.3-darwin-amd64 inspect /dev/disk7
Opening file at `/dev/disk7` in read-only mode ... OK.
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... validating checksum ... OK.

Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum:    0x9e22cdde3064fcea
OID:                0x1
XID:                0x29249
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: first block 0x4a626cc, spans 1 (0x1) blocks (last block 0x4a626cc)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1759.55.947.918.192
Block size:         4096 bytes
Block count:        976703436 (last block 0x3a374fcb)
Supported features:
- No flags.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- This container uses APFS version 2, as implemented in macOS 10.13 and iOS 10.3.
UUID:       9C132A77-662D-4CD3-A31C-EB6114D2E486
Next OID:                       0x29a93
Next XID:                       0x2924a
Space manager Ephemeral OID:    0x9924
Object map Physical OID:        0x4e91e3
Reaper Ephemeral OID:           0x401
Other flags:
- This container uses software cryptography.
--------------------------------------------------------------------------------

Locating the checkpoint descriptor area:
- Its length is 284 blocks.
- It is contiguous.
- The address of its first block is 0x3d5e8.
Loading the checkpoint descriptor area into memory ... OK.
Locating the most recent well-formed container superblock in the checkpoint descriptor area:
- It lies at index 7 within the checkpoint descriptor area.

Details of this container superblock:
--------------------------------------------------------------------------------
Stored checksum:    0x9e22c4c03065060b
OID:                0x1
XID:                0x29249
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: first block 0x4a626cc, spans 1 (0x1) blocks (last block 0x4a626cc)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1759.55.947.918.192
Block size:         4096 bytes
Block count:        976703436 (last block 0x3a374fcb)
Supported features:
- No flags.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- This container uses APFS version 2, as implemented in macOS 10.13 and iOS 10.3.
UUID:       9C132A77-662D-4CD3-A31C-EB6114D2E486
Next OID:                       0x29a93
Next XID:                       0x2924a
Space manager Ephemeral OID:    0x9924
Object map Physical OID:        0x4e91e3
Reaper Ephemeral OID:           0x401
Other flags:
- This container uses software cryptography.
--------------------------------------------------------------------------------
- The corresponding checkpoint starts at index 6 within the checkpoint descriptor area, and spans 2 blocks.

Loading the corresponding checkpoint ... OK.

Details of each block in this checkpoint:
--------------------------------------------------------------------------------
Stored checksum:    0x2c9ad29f92ecb2c9
OID:                0x3d5ee
XID:                0x29249
Storage type:       Physical
Type flags:         (no flags)
Type:               Checkpoint map
Subtype:            (invalid type / no subtype)
Flags:
- Last checkpoint-mapping block in the corresponding checkpoint.
Number of mappings: 20
--------------------------------------------------------------------------------
Stored checksum:    0x9e22c4c03065060b
OID:                0x1
XID:                0x29249
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: first block 0x4a626cc, spans 1 (0x1) blocks (last block 0x4a626cc)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1759.55.947.918.192
Block size:         4096 bytes
Block count:        976703436 (last block 0x3a374fcb)
Supported features:
- No flags.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- This container uses APFS version 2, as implemented in macOS 10.13 and iOS 10.3.
UUID:       9C132A77-662D-4CD3-A31C-EB6114D2E486
Next OID:                       0x29a93
Next XID:                       0x2924a
Space manager Ephemeral OID:    0x9924
Object map Physical OID:        0x4e91e3
Reaper Ephemeral OID:           0x401
Other flags:
- This container uses software cryptography.
--------------------------------------------------------------------------------

Details of each checkpoint-mapping in this checkpoint:
--------------------------------------------------------------------------------
Ephemeral OID:                      0x9924
Logical block address on disk:      0x39851
Object type:                        Space manager
Object subtype:                     (invalid type / no subtype)
Object size:                        8192 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x9925
Logical block address on disk:      0x39853
Object type:                        B-tree (root node)
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x405
Logical block address on disk:      0x39854
Object type:                        B-tree (root node)
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x401
Logical block address on disk:      0x39855
Object type:                        Container reaper
Object subtype:                     (invalid type / no subtype)
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x9911
Logical block address on disk:      0x39856
Object type:                        Container reaper list
Object subtype:                     (invalid type / no subtype)
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29322
Logical block address on disk:      0x39857
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a84
Logical block address on disk:      0x39858
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a85
Logical block address on disk:      0x39859
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a86
Logical block address on disk:      0x3985a
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a87
Logical block address on disk:      0x3985b
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a88
Logical block address on disk:      0x3985c
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a8a
Logical block address on disk:      0x3985d
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a8b
Logical block address on disk:      0x3985e
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a8c
Logical block address on disk:      0x3985f
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a8d
Logical block address on disk:      0x39860
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a8e
Logical block address on disk:      0x39861
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a8f
Logical block address on disk:      0x39862
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a90
Logical block address on disk:      0x39863
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a91
Logical block address on disk:      0x39864
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x29a92
Logical block address on disk:      0x39865
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
- There are 20 checkpoint-mappings in this checkpoint.

Reading the Ephemeral objects used by this checkpoint ... OK.
Validating the Ephemeral objects ... FAILED.
An Ephemeral object used by this checkpoint is malformed. Going back to look at the previous checkpoint instead.
END: Handling of this case has not yet been implemented.

What you are think about repairing this Volume?

Thank you for your work with this tool

[jivanpal]

Hi, Drat does not currently support anything related to encryption. Also, the failed Ephemeral object check currently performed by drat inspect is preventing inspection from proceeding. This will be removed in a future version and allow inspection to continue.