2

I had a Macbook Air Yosemite which was FileVault 2 encrypted. The laptop was stolen from me. The thief was able to reinstall OS X and some apps (was bringing it to market for sale). The laptop was then recovered and returned to me.

I still have the recovery key and password used to encrypt the original partition. Are the original encrypted files still recoverable? I understand there are several file-recovery software solutions for non encrypted drives. Are there any solutions available for this situation?

1 Answer 1

2

I'm afraid there are not many options given an ordinary, "home user" budget.

Theoretically you could send the drive in to a recovery service such as IBAS to get them to recover the original data on the drive. If this is even remotely possible depends on what kind of physical medium you had (i.e. is it SSD or spinning-platter hard drive). If they can recover everything, you can use the standard Apple tools to access the encrypted drive with your password or recovery key.

If you can't recover the full data set, you would have to inspect the data manually and probably create new tools for decrypting blocks of data using your recovery key. This will require specialized knowledge and skills, considerable amount of time - and with no guarantee of success. It is out of range for ordinary, home user purposes. FileVault 2 uses AES-XTS encryption - if you haven't got the recovery key and/or volume master key it is going to very hard (next to impossible) to decrypt.

2
  • Hi jksoegaard, I have the recovery key and original password. The question is how the recovery software works. I assume that -- on a block level -- the reformat overwrote some of the blocks on the drive (which is an SSD).
    – Daniel
    May 14, 2015 at 9:51
  • Ordinary recovery software cannot read what were in those blocks before they were overwritten. On that level - the content is lost. A specialized recovery service, such as IBAS or similar, could theoretically pick a part the SSD and access the internal memory to recover the content, if it still exists on the SSD - which it might do. It is difficult, expensive and with no guarantee of success.
    – jksoegaard
    May 14, 2015 at 10:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .