Switch to full style
Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
Post a reply

Mac Filevault Drive Accidental Format

April 16th, 2018, 12:50

I have been handed a real mess.

User accidently formatted a 32gb usb memory stick thinking he was formatting another attached drive.
From Terminal he sent the command 'erasedisk hfs+ externalgpt /dev/d:sk2' or something similar'.
Is that a quick erase leaving data recoverable or worse?
Then he spent a couple of days fiddling and recreated the partition/s and tried running recovery software. Ouch!!!

I have created a full 32gb image file.
Using a hex editor I don't see the usual "encrdsa" or hex value of "65 6E 63 72 63 64 73 61" entry in any partition.
In the encrypted partition I can see a mass of hex data which leads me to believe the format was not destructive.

If I plug the drive in to a Mac, Disk Utility can see an encrypted partition labled 'Mac Encrypted' but when I input the user password it is not accepted. Of course the password might be incorrect. Or might it be because the encrypted partition signature is missing?

I am thinking I might have to recreate the missing partition info and write it to the correct location and then attempt to unlock?
Post a reply