We have been looking at an OSX disk that may have been encrypted at time of imaging and are finding the following:

The EFI partition is in one piece and can be viewed

The system partition is completely blank and has only 'unallocated clusters' showing

The recovery partition appears intact

Does this mean that the system was encrypted with a boot-up password and as a result the whole partition was unreadable at time of imaging and so we are unable to recover even with the encryption codes?

I presume if it was one of the OSX FileVault encryptions we would not be able to see any of the disk as the whole disk is encrypted but would it register in Encase as unallocated clusters or something different?

---