cgsecurity.org

Hi - Does photorec work with a mounted Filevault 2 partition? Maybe another way to phrase my question is will photorec find the same files to recover on a Filevault 2 partition as it would have on an unencrypted partition?

I've mounted the encrypted partition with the keys, can browse the file structure, etc. Just trying to recover a deleted subfolder and files contained within.

Regards,
Mike

Try TestDisk, select the drive letter (ie E:), None, Advanced, Undelete.
If it failed, you can try PhotoRec on the same partition.

Hi - I'm just getting back to this and read through the examples and documentation. My source/original drive has been offline and not used until I have had time to focus on this in the new year.

A few questions if you can make time. I used DD to make a copy of the volumes from the source drive to a destination/blank drive, then I decrypted the Filevault volumes on the destination using the built in Mac Finder.

1. I see the destination drive where I want to recover files from using TestDisk, but I don't have an option to Undelete under Advanced. I see Type, Superblock, Image Creation, and Quit. Where is Undelete?
2. I started running PhotoRec on the destination drive and it is in process of running. I see a bunch of image files (TIFF, specifically DNG files). Many files I can view (great!!), but there are also blank files. Are blank files just unrecoverable, or could this have to do with the encryption such as PhotoRec finding old TIFF files that were encrypted using a prior Filevault 2 key? (In the past I'd "rotated" my Filevault key by decrypting, encrypting).

I could post chronology of what I think happened which a subfolder / files I'd deleted including info related to filevault keys if more info is needed.

Thank you.

Hi, help? Summary: 1. No undelete option.? 2. blank recovered files?

Sorry, undelete is not available fro HFS/HFS+ filesystem.
Some files recovered by PhotoRec may be damaged due to data fragmentation or partial data overwrite.