Page 1 of 1

Recovery of files after rsync deletion on encrypted drive

Posted: 13 Nov 2020, 13:46
by danp
I have an external Seagate 2TB drive, encrypted via Apple's disk encryption. This morning I deleted some files off it via rsync (not enough coffee).

I've been running photorec on it for the last hour and I'm getting back a ton of swf files and a few mp3, qxd, gpg and pst files. Neither of those are something I've stored before. What are these files?

Will it be possible to recover the files or am I screwed? I've got about 7 hours remaining before the process completes - is it worth continuing?

Appreciate any help.

Re: Recovery of files after rsync deletion on encrypted drive

Posted: 13 Nov 2020, 21:05
by recuperation
danp wrote: 13 Nov 2020, 13:46 I have an external Seagate 2TB drive, encrypted via Apple's disk encryption. This morning I deleted some files off it via rsync (not enough coffee).

I've been running photorec on it for the last hour and I'm getting back a ton of swf files and a few mp3, qxd, gpg and pst files. Neither of those are something I've stored before. What are these files?

Will it be possible to recover the files or am I screwed? I've got about 7 hours remaining before the process completes - is it worth continuing?

Appreciate any help.
Testdisk and Photorec only work on unencrypted drives. Maybe your operating system presents you such an unencrypted device as well once you unlocked your encryption.
Otherwise you'd be forced to remove encryption without writing any additional stuff on that disk and run Photorec afterwards.