Decrypt files recovered from encrypted external hard drive

data-recoveryencryptionfilevaulthard drive

I am trying to recover the data from one of the external hard drives of my company. I ended up using DiskDrill to extract all the files into a new, non-encrypted hard drive. Unfortunately I made the mistake of erasing the original hard drive before properly checking the exported data… :/

If I look at the recovered data, all the file structures and file sizes seem correct. But if I try to open any file I get a system error saying:

"The document “File.rtf” could not be opened."

I used cat to check the content of the file, and from the outcome it looks to me like it's still encrypted:

|?!?z?n;?AԒ??Ћ???f??Y?-?bA?-??ۚw?5?vc?D???yr????l?&yg?????U#
????F?????l??
??ٔ=??S?????#t????v:??#?˰wDZ$??y>?n??y??C?j??,???WI?L?[?a??CC?
P?U?>K?l?Ե???????OH?[Ẉ[Y?'^k?*?mDћ)?,0?Ի;
??^?\dW?|?`??=?c6&-~?\?YT+3w?4d?'?F@???D???G(?$??>??+?҃?6?t????p?M?wC[?:?$d1?{?Ϊ?.???~KW?r??Q?6??
o@???u???
?B|?[[??>/%???$??[;?z?h?!???O??dn??;?"?GZ?v?{W?B???[???P?d?!????d??Q?@?mG??/?|?x?_???H%)?v?Z??$?]????F??>?"????!U?rFl???
?GB2?W0Iy??]??|x??]X??aN[??????WJ??????l B??噡g?ہ'I???^}Yk>??Ǘ

The command:

file -  /Users/Cortana/Desktop/File.rtf

Returns:

application/octet-stream; charset=binary

The original disk was encrypted using FileVault. I do know the original password.

Is there any command I can run in terminal (or anything else really) that I can do to recover my data. I'm not an expert at unix so please explain it to me like I'm 5.

Thank you,
Danny

Best Answer

Unfortunately, you cannot recover the data.

From Apple's Support document: Use FileVault to encrypt the startup disk on your Mac

If you lose both your account password and your FileVault recovery key, you won't be able to log in to your Mac or access the data on your startup disk.