Accidentally deleted files on FileVault-encrypted disk, recovery impossible?

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
mken
Posts: 2
Joined: 26 Apr 2021, 18:51

Accidentally deleted files on FileVault-encrypted disk, recovery impossible?

#1 Post by mken »

I accidentally deleted files with rm on my Macbook (macOS Catalina 10.15.7) which has a FileVault-encrypted disk.

I tried running Photorec on all combinations of /dev/disk0, /dev/rdisk0, and /dev/rdisk1 and their partitions: unknown (entire disk), EFI System, and Apple APFS. The deleted files were various bits of source code so I selected tx? and txt file options. The only results were a small number of .plist files.

Would it be wise to turn off FileVault and rerun Photorec? I fear that unencrypting the disk would rewrite everything and wipe out any remaining chances of recovering those files.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Accidentally deleted files on FileVault-encrypted disk, recovery impossible?

#2 Post by recuperation »

I have no experience with Apple.
Is this File Vault 2?
If yes the whole disk is encrypted.
Similar to other whole disk encryption schemes in addition to the raw encrypted block device there should be a virtual unencrypted block device.
You should run Photorec with this device.
The fingerprints that Photorec are using are not visible anymore on encrypted devices.

mken
Posts: 2
Joined: 26 Apr 2021, 18:51

Re: Accidentally deleted files on FileVault-encrypted disk, recovery impossible?

#3 Post by mken »

Yes, it's encrypted with FileVault 2. Is the virtual unencrypted block device supposed to be in the list of disks? The only disks Photorec lists are /dev/disk0, /dev/rdisk0, and /dev/rdisk1, which I've already tried.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Accidentally deleted files on FileVault-encrypted disk, recovery impossible?

#4 Post by recuperation »

I have no experience with Apple, sorry.

Locked