OVERWRITE PARTITION WITH FILEVAULT

[jtb1982]

Greetings to everyone,

I hope this message finds you well.

I find myself in a situation where a client inadvertently overwrote an HFS+ partition with FileVault while attempting to create a bootable pen drive using an external drive. It appears that only 200MB of data were overwritten, and now the drive has three partitions. The first one is the bootable partition, the second is almost the entire size of the drive (1.81TB), and the third one contains only a few megabytes of data. The data extractor from PC3K informed me that the second partition has FileVault activated.

I am reaching out to inquire if anyone is familiar with software that can handle the deletion of an HFS+ partition with FileVault. So far, I have tried using PC3K data extractor, RStudio 9.0, and Recovery Explorer 9.17 without success.

I would greatly appreciate any hints or suggestions regarding how to proceed in this situation.

[Arch Stanton]

software that can handle the deletion of an HFS+ partition with FileVault

But that's not what this is. 200 MB or so (how was this determined) was overwritten and whatever meta data that happened to be there.

tried using PC3K data extractor, RStudio 9.0, and Recovery Explorer 9.17 without success

What does without success mean? it seems to me that doing a full scan with for example R-Studio should make it detect plain, non encrypted HFS meta data or even in absence of that, plenty RAW results. "Fails" tells us nothing.

[jtb1982]

What does without success mean? it seems to me that doing a full scan with for example R-Studio should make it detect plain, non encrypted HFS meta data or even in absence of that, plenty RAW results. "Fails" tells us nothing.

All the programs I try, none can find the deleted partition. I tried with r-studio, recovery explorer, reclaime pro and even with the data extractor(PC3K), with the winhex I see the drive full of data.

Arch Stanton thanks very much to take your time and answer me thanks very. Very possible this maybe be loosed, but I want to try anything which can work.

[Arch Stanton]

What does without success mean? it seems to me that doing a full scan with for example R-Studio should make it detect plain, non encrypted HFS meta data or even in absence of that, plenty RAW results. "Fails" tells us nothing.

All the programs I try, none can find the deleted partition. I tried with r-studio, recovery explorer, reclaime pro and even with the data extractor(PC3K), with the winhex I see the drive full of data.

Arch Stanton thanks very much to take your time and answer me thanks very. Very possible this maybe be loosed, but I want to try anything which can work.

I personally would use DMDE and see if the default quick partition search sees the partition (AFAIK there should be a backup volume header). So for that all you'd need to do is select the physical drive. DMDE by itself will run the quick partition scan.

Depending on how much of file systems structures were overwritten (client says 200 MB but we should not assume he's right) partial file system recovery is possible or not. Of course none of those tools tried finding much isn't a good sign.

[DR-Kiev]

Find boot CS (core storage ) it should be in 409640 (offset) , mount and decrypt. Ignore everything else.
If you lost CoreStorage metadata - game over. You won't be able to decrypt your data (FileVault).

[Arch Stanton]

OK. What ^^ he ^^ said then.

See? I can learn ..