All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 1 post ] 
Author Message
 Post subject: Mac Filevault Drive Accidental Format
PostPosted: April 16th, 2018, 12:50 
Offline

Joined: January 8th, 2008, 5:21
Posts: 925
Location: uk
I have been handed a real mess.

User accidently formatted a 32gb usb memory stick thinking he was formatting another attached drive.
From Terminal he sent the command 'erasedisk hfs+ externalgpt /dev/d:sk2' or something similar'.
Is that a quick erase leaving data recoverable or worse?
Then he spent a couple of days fiddling and recreated the partition/s and tried running recovery software. Ouch!!!

I have created a full 32gb image file.
Using a hex editor I don't see the usual "encrdsa" or hex value of "65 6E 63 72 63 64 73 61" entry in any partition.
In the encrypted partition I can see a mass of hex data which leads me to believe the format was not destructive.

If I plug the drive in to a Mac, Disk Utility can see an encrypted partition labled 'Mac Encrypted' but when I input the user password it is not accepted. Of course the password might be incorrect. Or might it be because the encrypted partition signature is missing?

I am thinking I might have to recreate the missing partition info and write it to the correct location and then attempt to unlock?


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1 post ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 46 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group