FileVault 2 Encrypted drive was reformatted by thief then returned. Is the original encrypted data salvageable

encryptionfilevaultSecurity

I had a Macbook Air Yosemite which was FileVault 2 encrypted. The laptop was stolen from me. The thief was able to reinstall OS X and some apps (was bringing it to market for sale). The laptop was then recovered and returned to me.

I still have the recovery key and password used to encrypt the original partition. Are the original encrypted files still recoverable? I understand there are several file-recovery software solutions for non encrypted drives. Are there any solutions available for this situation?

Best Answer

I'm afraid there are not many options given an ordinary, "home user" budget.

Theoretically you could send the drive in to a recovery service such as IBAS to get them to recover the original data on the drive. If this is even remotely possible depends on what kind of physical medium you had (i.e. is it SSD or spinning-platter hard drive). If they can recover everything, you can use the standard Apple tools to access the encrypted drive with your password or recovery key.

If you can't recover the full data set, you would have to inspect the data manually and probably create new tools for decrypting blocks of data using your recovery key. This will require specialized knowledge and skills, considerable amount of time - and with no guarantee of success. It is out of range for ordinary, home user purposes. FileVault 2 uses AES-XTS encryption - if you haven't got the recovery key and/or volume master key it is going to very hard (next to impossible) to decrypt.