All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 3 posts ] 
Author Message
 Post subject: Help with data recovery. Mac encrypted drive.
PostPosted: January 15th, 2018, 20:08 
Offline

Joined: January 15th, 2018, 20:00
Posts: 1
Location: United States
i,

I accidentally repartitioned my main storage hard drive, by using the following terminal command on it:

diskutil partitionDisk disk2 GPT JHFS+ "Canvio" 0g

To make matters worse I just realized the drive might have also been encrypted with firevault2. Not 100% sure but 95% sure. I have included screenshots of the terminal window before and after making my blunder. anyway to tell if the disk is encrypted from this?

the hard drive has about 3 TB of data on it. it has everything that I need. is there any way to get this data back by just simply re-creating the partitions? Meaning will software out there restore the partition table?

If the hard drive is not encrypted:
I have the following software: Disk Drill and Stellar Phoenix Mac data recovery. I could scan the whole hard drive for its content copy that to a new hard drive and copy it back, but I was wondering if there is any other easier way of doing this, where the partitions can just be re-created on the same hard drive.

however if the hard drive is encrypted ( I know the key)
is there any way to get the data back?

I am running 10.12.6



thanks for the help!!


Attachments:
File comment: HDinfo After formatting
After.png
After.png [ 17.06 KiB | Viewed 3206 times ]
File comment: HD info prior to formattinf
Before.png
Before.png [ 15.13 KiB | Viewed 3206 times ]
Top
 Profile  
 
 Post subject: Re: Help with data recovery. Mac encrypted drive.
PostPosted: January 15th, 2018, 21:34 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1626
Location: Italy
I do not recommend to play anymore directly on your drive, i mean that you shouldn't re-create or modify partitions on your drive.
Do not work anymore on it in writing mode or you will do things worse.

I suggest to clone the drive, then work on clone.
Once you have cloned it, you could try to decrypt filevault2 on clone drive by following this guide:
https://derflounder.wordpress.com/2011/ ... oot-drive/

also, you might find interesting the following thread:
https://forum.hddguru.com/viewtopic.php ... 89#p249089

After it gets decrypted, if you still can't get access into it, you might try to recover data with R-Studio or UFS Explorer.
Extract data on a third drive.

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI#MxP2J6ZNqXDcrX40I8MoQQ


Top
 Profile  
 
 Post subject: Re: Help with data recovery. Mac encrypted drive.
PostPosted: January 16th, 2018, 11:52 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3561
Location: Chicago
rimmi2002 wrote:
i,
is there any way to get this data back by just simply re-creating the partitions?

No
Filevault2 relies on CoreStorage
CoreStorage (CS) has several chunks of metadata
First chunk is CS Volume Header, it is located at the beginning and at the end of a volume. CS Volume Header has UNIQUE ENCRYPTION KEY that encrypts other chunks of metadata. Recreating partitions won't re-create the encryption key. Without the key you cannot decrypt CS metadata and without metadata you cannot decrypt the volume. Meaning you are in really bad situation.

There is a very high chance that the first copy of CS Voluem Header is re-written with new partition. However the second copy might be alive because from what I see you've had slightly different partition schema before re-format.

You need a professional who really knows how to work with FileVault2 to recover this data. I suggest you to find one.

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 3 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 69 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group