Data Recovery and Disk Utilities Forum @R-TT

Hi,

I would appreciate any help on this matter. I accidentally formatted (in Disk Utility on a Macbook) a partition on my external backup disk, full of our family photo collection. (I have other backups, but they are missing the most recent updates...) Only this partition on the disk was encrypted by Disk Utility. I ran R-Studio (Demo) (on the same computer that was used to encrypt the partition) and R-Studio sees the partition as recognized, but I see no "regular" files (images) and don't know how to proceed. Maybe I am doing something wrong, since I do not have any experience in data recovery... Is recovery in this situation even possible?
Any help would be appreciated, thanks!
Toni

If you formatted the encrypted partition when it was locked, well, sorry, your're out of luck.
If when it was unlocked, maybe both these articles may help (better to read in this order):
Data Recovery from Various File Container Formats and Encrypted Disks - this is not about the Mac disk, but the general idea must be clear.
Data Recovery from an Erased HFS or HFS+ Disk this is how to recover files after reformatting a Mac disk and what to expect from such recovery.

Hi Alt,

Thank you for your reply! I read both articles, thank you. I formatted the drive when it was unlocked, as far as I remember, but I formatted it to unencrypted (OS X extended, journaled, encrypted to OSX extended, Journaled). So, I can mount it with no problems, since it is not asking me for a password or anything. I think that the problem is that I can't get to the "underlying encrypted disk", since it mounts as unencrypted after the new formatting, if you know what I mean... So, probably I have to figure out if it is possible to reinstate the encryption somehow?

Actually, this is the first case - you replaced the encrypted partition with an unencrypted one. Sorry, but I believe no hope. The data from the previous partition remains scrambled, and no way to unscramble it even with knowing the old password.

Depending on your initial setup of Filevault, your apple account may have a backup of the recovery key (that's offered when you set the encryption). Even with that key, it'd take a fair bit of investigation and custom work to decrypt, but having that key it might be possible. However, given that you've overwritten the cabinet file with an non-encrypted one, you'd be limited to a RAW recovery w/o many file names or folder structure even then.

Thank you all for your replies. It seems like a lost cause and I confirmed it I guess with the following test.

I did a test with a thumb drive. I first formatted it to HFS+ encrypted in Disk Utility, put 450 MB of jpgs on it, reformatted with HFS+ encrypted again. I removed the drive from the computer and before mounting it again I was asked for the password. Scanned everything with R-studio and could not find any of the newly added jpgs... (found some ancient mp3s and jpgs from previous FAT partitions though). So, even if I reformat with HFS+ encrypted (the same as the initial format) I cannot restore the data.

Well, I guess I won't be encrypting anything anymore, just to be on the safe side;)

kolerabica wrote: Well, I guess I won't be encrypting anything anymore, just to be on the safe side;)

There's a better solution: backup. With the prices of storage devices going constantly down, this is also quite affordable.

kolerabica wrote:So, even if I reformat with HFS+ encrypted (the same as the initial format) I cannot restore the data.

Any idiot who knows a tiny bit about encryption could have told you that. Encryption always uses a randomly generated DEK(disk encryption key), so each time you encrypt it's using a different one. Your password is only used to re-encrypt the DEK.

However, like I told you before the Apple account on the computer may have a backup of the DEK (it's an option Apple gives when you first do the encryption). Microsoft does the same thing with their BitLocker encryption because they know people occasionally do stupid stuff like formatting the wrong drive.