Recovery off Filevault 2 partition

Using PhotoRec to recover lost data
Post Reply
Message
Author
mikejyo
Posts: 3
Joined: 25 Aug 2016, 22:25

Recovery off Filevault 2 partition

#1 Post by mikejyo » 25 Aug 2016, 23:03

Hi - Does photorec work with a mounted Filevault 2 partition? Maybe another way to phrase my question is will photorec find the same files to recover on a Filevault 2 partition as it would have on an unencrypted partition?

I've mounted the encrypted partition with the keys, can browse the file structure, etc. Just trying to recover a deleted subfolder and files contained within.

Regards,
Mike

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3758
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovery off Filevault 2 partition

#2 Post by cgrenier » 26 Aug 2016, 06:27

Try TestDisk, select the drive letter (ie E:), None, Advanced, Undelete.
If it failed, you can try PhotoRec on the same partition.

mikejyo
Posts: 3
Joined: 25 Aug 2016, 22:25

Re: Recovery off Filevault 2 partition

#3 Post by mikejyo » 12 Jan 2017, 18:35

Hi - I'm just getting back to this and read through the examples and documentation. My source/original drive has been offline and not used until I have had time to focus on this in the new year.

A few questions if you can make time. I used DD to make a copy of the volumes from the source drive to a destination/blank drive, then I decrypted the Filevault volumes on the destination using the built in Mac Finder.

1. I see the destination drive where I want to recover files from using TestDisk, but I don't have an option to Undelete under Advanced. I see Type, Superblock, Image Creation, and Quit. Where is Undelete?
2. I started running PhotoRec on the destination drive and it is in process of running. I see a bunch of image files (TIFF, specifically DNG files). Many files I can view (great!!), but there are also blank files. Are blank files just unrecoverable, or could this have to do with the encryption such as PhotoRec finding old TIFF files that were encrypted using a prior Filevault 2 key? (In the past I'd "rotated" my Filevault key by decrypting, encrypting).

I could post chronology of what I think happened which a subfolder / files I'd deleted including info related to filevault keys if more info is needed.

Thank you.

mikejyo
Posts: 3
Joined: 25 Aug 2016, 22:25

Re: Recovery off Filevault 2 partition

#4 Post by mikejyo » 17 Jan 2017, 23:25

Hi, help? Summary: 1. No undelete option.? 2. blank recovered files?

User avatar
cgrenier
Site Admin
Posts: 3758
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovery off Filevault 2 partition

#5 Post by cgrenier » 02 Feb 2017, 11:34

Sorry, undelete is not available fro HFS/HFS+ filesystem.
Some files recovered by PhotoRec may be damaged due to data fragmentation or partial data overwrite.

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests