2

I am trying to recover the data from one of the external hard drives of my company. I ended up using DiskDrill to extract all the files into a new, non-encrypted hard drive. Unfortunately I made the mistake of erasing the original hard drive before properly checking the exported data... :/

If I look at the recovered data, all the file structures and file sizes seem correct. But if I try to open any file I get a system error saying:

"The document “File.rtf” could not be opened."

I used cat to check the content of the file, and from the outcome it looks to me like it's still encrypted:

|?!?z?n;?AԒ??Ћ???f??Y?-?bA?-??ۚw?5?vc?D???yr????l?&yg?????U# ????F?????l?? ??ٔ=??S?????#t????v:??#?˰wDZ$??y>?n??y??C?j??,???WI?L?[?a??CC? P?U?>K?l?Ե???????OH?[Ẉ[Y?'^k?*?mDћ)?,0?Ի; ??^?\dW?|?`??=?c6&-~?\?YT+3w?4d?'?F@???D???G(?$??>??+?҃?6?t????p?M?wC[?:?$d1?{?Ϊ?.???~KW?r??Q?6?? o@???u??? ?B|?[[??>/%???$??[;?z?h?!???O??dn??;?"?GZ?v?{W?B???[???P?d?!????d??Q?@?mG??/?|?x?_???H%)?v?Z??$?]????F??>?"????!U?rFl??? ?GB2?W0Iy??]??|x??]X??aN[??????WJ??????l B??噡g?ہ'I???^}Yk>??Ǘ

The command:

file -  /Users/Cortana/Desktop/File.rtf

Returns:

application/octet-stream; charset=binary

The original disk was encrypted using FileVault. I do know the original password.

Is there any command I can run in terminal (or anything else really) that I can do to recover my data. I'm not an expert at unix so please explain it to me like I'm 5.

Thank you, Danny

1

Unfortunately, you cannot recover the data.

From Apple's Support document: Use FileVault to encrypt the startup disk on your Mac

If you lose both your account password and your FileVault recovery key, you won't be able to log in to your Mac or access the data on your startup disk.

  • Thanks Allan, I do have the password that was used for encryption (the FileVault recovery key). – Danny Bravo Nov 28 '18 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .