Help needed to access Veracrypt wallets after MacBook disaster REWARD

I need some urgent help with a tricky data recovery situation involving my 2015 MacBook Pro that has a soldered SSD (about 1TB). There might be a hidden Veracrypt or TrueCrypt volume on it that has crypto wallet info. I'm looking to recover this encrypted volume or any related wallet files. I'm willing to give a pretty nice reward to anyone who can help me out with this. Here’s the background: • The MacBook probably had a hidden Veracrypt volume on the internal SSD. • This volume likely contained important crypto wallet files, including: ◦ Cake Wallet (Monero) probably stored with a .keys file or a 25-word seed phrase. ◦ XMR (Monero official wallet) ◦ Exodus wallet • The laptop faced: ◦ A failed Linux dual-boot installation that might’ve overwritten parts of the drive. ◦ It was reformatted and set up with macOS APFS volumes, which now show almost the whole drive as "free space." • The Veracrypt volume can’t be seen or mounted anymore, and tools like TestDisk and PhotoRec haven’t been able to find it. What I’m trying to recover: • The hidden Veracrypt volume, if it’s still somewhere on the SSD (like in unallocated or untouched sectors). • Any bits or complete copies of: ◦ wallet.stronghold ◦ .keys, .json, or .txt files ◦ Plaintext or partial seed phrases • A forensic clone or chip-off recovery if needed to get around TRIM or file system issues. A few technical notes: • The SSD is soldered (not removable). • The Veracrypt header might have been overwritten.

This board is for Bitcoin-related questions, not for physical hardware recovery.

It’s a wallet with bitcoin in it and I’m even offering a reward. It’s also the tech support forum. Next time you meet a nice girl you should tell her you moonlight as a bitcoin tech support forum monitor. Real pantie dropper.

First of all, have you tried making raw copy of that SSD? After doing that, you can try perform recovery and analysis rather than SSD itself to prevent accidental overwrite. AFAIK if you can't locate or have backup of TeraCrypt/VeraCrypt header (that store data required for decryption), usually it's considered as lost cause. And despite name of this board, people who make reply usually are community member rather than real expert or professional.

Absolutely will be cloning it for tests! I thought the same about finding the data but i think there are ways around it and some genius may know it. Cheers

I don't know how MacOS handles TRIM but I would assume due to not easily replaceable soldered SSD storage that reformated and reinitialized "free space" has been TRIMed already. Question is now how and what data Apple SSD flash storage returns when read again after being TRIMed. Regarding data recovery from flash media I read somewhere that TRIMed areas can return either garbage, zeroes or (if lucky) the old data that was stored. The problem is that flash media doesn't behave like oldschool harddrive media. Data blocks can be remapped, garbage collection of the flash controller can destroy data of TRIMed regions as those regions are not considered to have data that needs to be kept. From what I read, data recovery from flash media can be really problematic if you can't stop or avoid the nastywith respect to data recovery things like TRIM and other flash storage controller specialties of wear leveling. Creating a forensic image of the SSD storage should have been done as early as possible. It doesn't sound like it has been done, does it? To evaluate further recovery chances one could try to determine what data is recoverable from TRIMed regions of this MacBook model, preferably with another similar MacBook and MacOS version. Because, if TRIMed regions don't return their previous data, I doubt it's worth to proceed further recovery attempts.