I am trying to recover the data from one of the external hard drives of my company. I ended up using DiskDrill to extract all the files into a new, non-encrypted hard drive. Unfortunately I made the mistake of erasing the original hard drive before properly checking the exported data… :/
If I look at the recovered data, all the file structures and file sizes seem correct. But if I try to open any file I get a system error saying:
"The document “File.rtf” could not be opened."
I used cat to check the content of the file, and from the outcome it looks to me like it's still encrypted:
|?!?z?n;?AԒ??Ћ???f??Y?-?bA?-??ۚw?5?vc?D???yr????l?&yg?????U#
????F?????l??
??ٔ=??S?????#t????v:??#?˰wDZ$??y>?n??y??C?j??,???WI?L?[?a??CC?
P?U?>K?l?Ե???????OH?[Ẉ[Y?'^k?*?mDћ)?,0?Ի;
??^?\dW?|?`??=?c6&-~?\?YT+3w?4d?'?F@???D???G(?$??>??+?҃?6?t????p?M?wC[?:?$d1?{?Ϊ?.???~KW?r??Q?6??
o@???u???
?B|?[[??>/%???$??[;?z?h?!???O??dn??;?"?GZ?v?{W?B???[???P?d?!????d??Q?@?mG??/?|?x?_???H%)?v?Z??$?]????F??>?"????!U?rFl???
?GB2?W0Iy??]??|x??]X??aN[??????WJ??????l B??噡g?ہ'I???^}Yk>??Ǘ
The command:
file - /Users/Cortana/Desktop/File.rtf
Returns:
application/octet-stream; charset=binary
The original disk was encrypted using FileVault. I do know the original password.
Is there any command I can run in terminal (or anything else really) that I can do to recover my data. I'm not an expert at unix so please explain it to me like I'm 5.
Thank you,
Danny
Best Answer
Unfortunately, you cannot recover the data.
From Apple's Support document: Use FileVault to encrypt the startup disk on your Mac