I am trying to recover the data from one of the external hard drives of my company. I ended up using DiskDrill to extract all the files into a new, non-encrypted hard drive. Unfortunately I made the mistake of erasing the original hard drive before properly checking the exported data... :/
If I look at the recovered data, all the file structures and file sizes seem correct. But if I try to open any file I get a system error saying:
"The document “File.rtf” could not be opened."
I used cat to check the content of the file, and from the outcome it looks to me like it's still encrypted:
|?!?z?n;?AԒ??Ћ???f??Y?-?bA?-??ۚw?5?vc?D???yr????l?&yg?????U# ????F?????l?? ??ٔ=??S?????#t????v:??#?˰wDZ$??y>?n??y??C?j??,???WI?L?[?a??CC? P?U?>K?l?Ե???????OH?[Ẉ[Y?'^k?*?mDћ)?,0?Ի; ??^?\dW?|?`??=?c6&-~?\?YT+3w?4d?'?F@???D???G(?$??>??+?҃?6?t????p?M?wC[?:?$d1?{?Ϊ?.???~KW?r??Q?6?? o@???u??? ?B|?[[??>/%???$??[;?z?h?!???O??dn??;?"?GZ?v?{W?B???[???P?d?!????d??Q?@?mG??/?|?x?_???H%)?v?Z??$?]????F??>?"????!U?rFl??? ?GB2?W0Iy??]??|x??]X??aN[??????WJ??????l B??噡g?ہ'I???^}Yk>??Ǘ
The command:
file - /Users/Cortana/Desktop/File.rtf
Returns:
application/octet-stream; charset=binary
The original disk was encrypted using FileVault. I do know the original password.
Is there any command I can run in terminal (or anything else really) that I can do to recover my data. I'm not an expert at unix so please explain it to me like I'm 5.
Thank you, Danny
