Recovery off Filevault 2 partition

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
mikejyo
Posts: 3
Joined: 25 Aug 2016, 22:25

Recovery off Filevault 2 partition

#1 Post by mikejyo »

Hi - Does photorec work with a mounted Filevault 2 partition? Maybe another way to phrase my question is will photorec find the same files to recover on a Filevault 2 partition as it would have on an unencrypted partition?

I've mounted the encrypted partition with the keys, can browse the file structure, etc. Just trying to recover a deleted subfolder and files contained within.

Regards,
Mike

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovery off Filevault 2 partition

#2 Post by cgrenier »

Try TestDisk, select the drive letter (ie E:), None, Advanced, Undelete.
If it failed, you can try PhotoRec on the same partition.

mikejyo
Posts: 3
Joined: 25 Aug 2016, 22:25

Re: Recovery off Filevault 2 partition

#3 Post by mikejyo »

Hi - I'm just getting back to this and read through the examples and documentation. My source/original drive has been offline and not used until I have had time to focus on this in the new year.

A few questions if you can make time. I used DD to make a copy of the volumes from the source drive to a destination/blank drive, then I decrypted the Filevault volumes on the destination using the built in Mac Finder.

1. I see the destination drive where I want to recover files from using TestDisk, but I don't have an option to Undelete under Advanced. I see Type, Superblock, Image Creation, and Quit. Where is Undelete?
2. I started running PhotoRec on the destination drive and it is in process of running. I see a bunch of image files (TIFF, specifically DNG files). Many files I can view (great!!), but there are also blank files. Are blank files just unrecoverable, or could this have to do with the encryption such as PhotoRec finding old TIFF files that were encrypted using a prior Filevault 2 key? (In the past I'd "rotated" my Filevault key by decrypting, encrypting).

I could post chronology of what I think happened which a subfolder / files I'd deleted including info related to filevault keys if more info is needed.

Thank you.

mikejyo
Posts: 3
Joined: 25 Aug 2016, 22:25

Re: Recovery off Filevault 2 partition

#4 Post by mikejyo »

Hi, help? Summary: 1. No undelete option.? 2. blank recovered files?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovery off Filevault 2 partition

#5 Post by cgrenier »

Sorry, undelete is not available fro HFS/HFS+ filesystem.
Some files recovered by PhotoRec may be damaged due to data fragmentation or partial data overwrite.

Locked