Home » Questions » Computers [ Ask a new question ]

Is it possible to recover deleted files from a home folder encrypted with FileVault?

Is it possible to recover deleted files from a home folder encrypted with FileVault?

I've erased all contents in the boot partition of my Mac. I thought I had an up-to-date backup using TimeMachine, but unfortunately the home folder wasn't backed up at all, because it was encrypted using FileVault.

Asked by: Guest | Views: 282
Total answers/comments: 1
Guest [Entry]

"You need to try to recover the FileVault disk image; if you can get that back, you can mount it (though you need to supply your old login password to decrypt it). In Mac OS v10.3-10.4, the disk image was a single file; in v10.5, they switched to using a sparse bundle format, which breaks the image into a bunch of ""band"" files, and I'm pretty sure you need to get all of them (and arrange them into the appropriate sparsebundle directory structure) to make the image mountable. Here's the directory structure from my fvtest account (note that this is inside /Users/fvtest, but that doesn't matter for reconstruction purposes):

fvtest.sparsebundle/
Info.bckup
Info.plist
token
bands/
0
1
2
3
37e5
4
5
6
d0
d1
d2
d3
d4

Note that each of the band files is around 8MB, so if this is an account with a significant amount of data in it, there'll be quite a few of them. The usual rules about data recovery apply, such as not writing anything to the disk until you're done recovering. Since OS X has really annoying habits about writing data to disks without being asked to -- spotlight indexes, for example -- it's best to mount the disk readonly if at all possible."