Switch to full style
Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
Post a reply

Help with data recovery. Mac encrypted drive.

January 15th, 2018, 20:08

i,

I accidentally repartitioned my main storage hard drive, by using the following terminal command on it:

diskutil partitionDisk disk2 GPT JHFS+ "Canvio" 0g

To make matters worse I just realized the drive might have also been encrypted with firevault2. Not 100% sure but 95% sure. I have included screenshots of the terminal window before and after making my blunder. anyway to tell if the disk is encrypted from this?

the hard drive has about 3 TB of data on it. it has everything that I need. is there any way to get this data back by just simply re-creating the partitions? Meaning will software out there restore the partition table?

If the hard drive is not encrypted:
I have the following software: Disk Drill and Stellar Phoenix Mac data recovery. I could scan the whole hard drive for its content copy that to a new hard drive and copy it back, but I was wondering if there is any other easier way of doing this, where the partitions can just be re-created on the same hard drive.

however if the hard drive is encrypted ( I know the key)
is there any way to get the data back?

I am running 10.12.6



thanks for the help!!
Attachments
After.png
HDinfo After formatting
Before.png
HD info prior to formattinf
Before.png (15.13 KiB) Viewed 3207 times

Re: Help with data recovery. Mac encrypted drive.

January 15th, 2018, 21:34

I do not recommend to play anymore directly on your drive, i mean that you shouldn't re-create or modify partitions on your drive.
Do not work anymore on it in writing mode or you will do things worse.

I suggest to clone the drive, then work on clone.
Once you have cloned it, you could try to decrypt filevault2 on clone drive by following this guide:
https://derflounder.wordpress.com/2011/ ... oot-drive/

also, you might find interesting the following thread:
https://forum.hddguru.com/viewtopic.php ... 89#p249089

After it gets decrypted, if you still can't get access into it, you might try to recover data with R-Studio or UFS Explorer.
Extract data on a third drive.

Re: Help with data recovery. Mac encrypted drive.

January 16th, 2018, 11:52

rimmi2002 wrote:i,
is there any way to get this data back by just simply re-creating the partitions?

No
Filevault2 relies on CoreStorage
CoreStorage (CS) has several chunks of metadata
First chunk is CS Volume Header, it is located at the beginning and at the end of a volume. CS Volume Header has UNIQUE ENCRYPTION KEY that encrypts other chunks of metadata. Recreating partitions won't re-create the encryption key. Without the key you cannot decrypt CS metadata and without metadata you cannot decrypt the volume. Meaning you are in really bad situation.

There is a very high chance that the first copy of CS Voluem Header is re-written with new partition. However the second copy might be alive because from what I see you've had slightly different partition schema before re-format.

You need a professional who really knows how to work with FileVault2 to recover this data. I suggest you to find one.
Post a reply