0

I'm trying to restore a crashed hard drive. Using Softtote Data Recovery for Mac, I have recovered 8000+ files. I can't use any of them. Brainstorming with the user, he forgot that he has FileVault enabled.

Is there any way to recover data from a crashed hard drive with FileVault enabled?

The drive in question is an external drive that connects to the Mac using FireWire 800. We are running Mountain Lion so this is a FileVault 2 situation.

Improve this question
5
  • Yes - there are several ways to do this - do you have any specific requirements or want a survey of options?
    – bmike ♦
    Commented Apr 28, 2013 at 14:59
  • Thanks BMike, the drive is a 250GB external drive connected on FW800. I would really appreciate any specific methods. I have enough storage to copy saved files. I would like to save any photo, document and audio files.
    – ICL1901
    Commented Apr 28, 2013 at 15:05
  • Is this FileVault 2 (encrypted volume) or FileVault 1 (encrypted home folder)? The fact that you're getting any files at all suggests FV1, which requires a completely different approach than FV2...
    – Gordon Davisson
    Commented Apr 28, 2013 at 17:26
  • Please edit in more detail. What drive was encrypted? What OS encrypted it? Do you suspect the drive is broken or just the data has become corrupt?
    – bmike ♦
    Commented Apr 28, 2013 at 20:05
  • apple.stackexchange.com/q/230379/8546 has some more recent answers that may be of interest.
    – Graham Perrin
    Commented Jul 17, 2016 at 16:40

1 Answer 1

Reset to default
1

Since it's now clear you have an external drive, I don't know how much of this applies, but I'll leave it in case it helps someone in that situation.

I typically boot the mac into Target Disk Mode and use another Mac to enter the password for any account on the FileVault Mac to mount the encrypted core storage drive under OS X. If the Mac was set up with a recovery key, you could also use that to unlock the volume and read from the actual files and not the encrypted data.

At this point, you can read / write to the raw device or use the normal file system tools or run your program or Disk Warrior or Drive Genius to scavenge blocks as if the drive were a normal, non-FileVault 2 drive.

Trying to copy the encrypted raw blocks off the drive is futile without NSA / FBI level of funding, tools and know-how. There are people that do this professionally, but I'm not one of them. Also, since your drive isn't showing the normal "enter your password" to unlock dialog, it's not clear you can do anything but look for other copies of the data or get a quote from a professional data recovery service to see if they are willing to try to get things back.

Personally, if I had a FileVault drive that went bad, I'd probable just call up Kroll Ontrack or another professional firm and get a quote for their assistance. In the end, it would either be data I could restore from backup, write off as a loss, or pay $$$ to get back.

Improve this answer
8
  • BMike, how do you " use a recovery key". I have my son's FV encryption code, but I've never used File Vault.
    – ICL1901
    Commented Apr 28, 2013 at 15:15
  • 2
    @DavidDelMonte Once you can access the disk on a FV2-supporting version of OS X, it will prompt you for a "password" -- entering the password of a boot-enabled user sufficed in my case, though
    – Ryccardo
    Commented Apr 28, 2013 at 16:09
  • @BMike. I think I'm being dense. Those instructions are great, if this were my Mac that was having a problem. How would I use these instructions on an external drive? Why would I boot my mac into target mode if it's not this computer that's having a problem?
    – ICL1901
    Commented Apr 28, 2013 at 19:02
  • If you list the exact model of Mac you have, I'll add detains on your options. You might get support from Apple if its under warranty or a Genius Bar is close. that way, you don't have to know what details are neede to provide a proper answer.
    – bmike ♦
    Commented Apr 28, 2013 at 20:03
  • I must not be clear. IT's hard to type as I have low vision. My mac is not the problem, it's an external drive that belongs to my son.
    – ICL1901
    Commented Apr 28, 2013 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .