I have an external Seagate 2TB drive, encrypted via Apple's disk encryption. This morning I deleted some files off it via rsync (not enough coffee).
I've been running photorec on it for the last hour and I'm getting back a ton of swf files and a few mp3, qxd, gpg and pst files. Neither of those are something I've stored before. What are these files?
Will it be possible to recover the files or am I screwed? I've got about 7 hours remaining before the process completes - is it worth continuing?
Appreciate any help.
Recovery of files after rsync deletion on encrypted drive
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
recuperation
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Recovery of files after rsync deletion on encrypted drive
Testdisk and Photorec only work on unencrypted drives. Maybe your operating system presents you such an unencrypted device as well once you unlocked your encryption.danp wrote: ↑13 Nov 2020, 13:46 I have an external Seagate 2TB drive, encrypted via Apple's disk encryption. This morning I deleted some files off it via rsync (not enough coffee).
I've been running photorec on it for the last hour and I'm getting back a ton of swf files and a few mp3, qxd, gpg and pst files. Neither of those are something I've stored before. What are these files?
Will it be possible to recover the files or am I screwed? I've got about 7 hours remaining before the process completes - is it worth continuing?
Appreciate any help.
Otherwise you'd be forced to remove encryption without writing any additional stuff on that disk and run Photorec afterwards.