I erased my encrypted volume. Any hope?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Davd29
Posts: 1
Joined: 15 Mar 2019, 12:21

I erased my encrypted volume. Any hope?

#1 Post by Davd29 »

I could really use some help. I had several hard drives attached to my Mac and I erased the wrong one.

The drive in question is a 4TB Toshiba mechanism (model HDWE140) housed inside a Toshiba chassis. I originally set up the drive using Disk Utility (on the Mac) with a GUID partition scheme. I created one large partition (called “Datastore”) which was formatted as a “Mac OS Extended (Journaled, Encrypted)” volume (actually a CoreStorage Logical Volume I believe). I know the password that was used and this drive has worked reliably for several years in that configuration.

(Even though I set it up as one large partition, my understanding is that sometimes the Mac will also create a hidden “Recovery” partition on the same drive as well. I am about 75% certain it had done so in this case.)

I mistakenly had the Disk Utility program erase the “Datastore” partition. It then created a new “Untitled” partition formatted as Mac OS Extended (Journaled) volume. That step took about 5 seconds.

I am trying to determine if it is possible to retrieve my files and hopefully the folder structure around them.

I have hardly used the disk at all since this happened a few days ago. I’ve mounted the drive (read the file system) a few times because I wanted to collect info about the drive. However I have not “saved” any files to it (beyond the various invisible files that the Mac OS places on a new disk).

So in summary: I erased the main “Mac OS Extended (Journaled, Encrypted)” volume on a drive, and replaced it with a “Mac OS Extended (Journaled)” volume. I haven’t stored any files on the drive since. I have the password that was used to encrypt the drive.

Any hope for getting my files (and hopefully the folder structure) back? I am willing to dig in and learn everything I need to to fix this. I am just trying to first figure out if it's even possible. If it is, then some idea of the procedure would be helpful.

Thanks in advance for any help that can be provided.

David29

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: I erased my encrypted volume. Any hope?

#2 Post by cgrenier »

As the encrypted volume as been reformated, I don't think it's possible to recover the data previously stored on the encrypted volume.

Locked