Joined: January 8th, 2008, 5:21 Posts: 925 Location: uk
|
I have been handed a real mess.
User accidently formatted a 32gb usb memory stick thinking he was formatting another attached drive. From Terminal he sent the command 'erasedisk hfs+ externalgpt /dev/d:sk2' or something similar'. Is that a quick erase leaving data recoverable or worse? Then he spent a couple of days fiddling and recreated the partition/s and tried running recovery software. Ouch!!!
I have created a full 32gb image file. Using a hex editor I don't see the usual "encrdsa" or hex value of "65 6E 63 72 63 64 73 61" entry in any partition. In the encrypted partition I can see a mass of hex data which leads me to believe the format was not destructive.
If I plug the drive in to a Mac, Disk Utility can see an encrypted partition labled 'Mac Encrypted' but when I input the user password it is not accepted. Of course the password might be incorrect. Or might it be because the encrypted partition signature is missing?
I am thinking I might have to recreate the missing partition info and write it to the correct location and then attempt to unlock?
|
|