Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm trying to restore a crashed hard drive. Using Softtote Data Recovery for Mac, I have recovered 8000+ files. I can't use any of them. Brainstorming with the user, he forgot that he has File Vault enabled.

Is there any way to recover data from a crashed hard drive with FV enabled?

The drive in question is an external drive that connects to the Mac using FireWire 800. We are running Mountain Lion so this is a FileVault 2 situation.

share|improve this question
    
Yes - there are several ways to do this - do you have any specific requirements or want a survey of options? –  bmike Apr 28 '13 at 14:59
    
Thanks BMike, the drive is a 250GB external drive connected on FW800. I would really appreciate any specific methods. I have enough storage to copy saved files. I would like to save any photo, document and audio files. –  David DelMonte Apr 28 '13 at 15:05
    
Is this FileVault 2 (encrypted volume) or FileVault 1 (encrypted home folder)? The fact that you're getting any files at all suggests FV1, which requires a completely different approach than FV2... –  Gordon Davisson Apr 28 '13 at 17:26
    
Please edit in more detail. What drive was encrypted? What OS encrypted it? Do you suspect the drive is broken or just the data has become corrupt? –  bmike Apr 28 '13 at 20:05

1 Answer 1

Since it's now clear you have an external drive, I don't know how much of this applies, but I'll leave it in case it helps someone in that situation.

I typically boot the mac into Target Disk Mode and use another Mac to enter the password for any account on the Filevault Mac to mount the encrypted core storage drive under OS X. If the Mac was set up with a recovery key, you could also use that to unlock the volume and read from the actual files and not the encrypted data.

At this point, you can read / write to the raw device or use the normal filesystem tools or run your program or Disk Warrior or Drive Genius to scavenge blocks as if the drive were a normal, non-FileVault 2 drive.

Trying to copy the encrypted raw blocks off the drive is futile without NSA / FBI level of funding, tools and know-how. There are people that do this professionally, but I'm not one of them. Also, since your drive isn't showing the normal "enter your password" to unlock dialog, it's not clear you can do anything but look for other copies of the data or get a quote from a professional data recovery service to see if they are willing to try to get things back.


Personally, if I had a file vault drive that went bad, I'd probable just call up Kroll Ontrack or another professional firm and get a quote for their assistance. In the end, it would either be data I could restore from backup, write off as a loss, or pay $$$ to get back.

share|improve this answer
    
BMike, how do you " use a recovery key". I have my son's FV encryption code, but I've never used File Vault. –  David DelMonte Apr 28 '13 at 15:15
2  
@DavidDelMonte Once you can access the disk on a FV2-supporting version of OS X, it will prompt you for a "password" -- entering the password of a boot-enabled user sufficed in my case, though –  Ryccardo Apr 28 '13 at 16:09
    
Cool idea Ryccardo. Thanks, I'll try that. –  David DelMonte Apr 28 '13 at 16:21
    
@BMike. I think I'm being dense. Those instructions are great, if this were my Mac that was having a problem. How would I use these instructions on an external drive? Why would I boot my mac into target mode if it's not this computer that's having a problem? –  David DelMonte Apr 28 '13 at 19:02
    
If you list the exact model of Mac you have, I'll add detains on your options. You might get support from Apple if its under warranty or a Genius Bar is close. that way, you don't have to know what details are neede to provide a proper answer. –  bmike Apr 28 '13 at 20:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.