I'm trying to restore a crashed hard drive. Using Softtote Data Recovery for Mac, I have recovered 8000+ files. I can't use any of them. Brainstorming with the user, he forgot that he has FileVault enabled.
Is there any way to recover data from a crashed hard drive with FileVault enabled?
The drive in question is an external drive that connects to the Mac using FireWire 800. We are running Mountain Lion so this is a FileVault 2 situation.
Best Answer
Since it's now clear you have an external drive, I don't know how much of this applies, but I'll leave it in case it helps someone in that situation.
I typically boot the mac into Target Disk Mode and use another Mac to enter the password for any account on the FileVault Mac to mount the encrypted core storage drive under OS X. If the Mac was set up with a recovery key, you could also use that to unlock the volume and read from the actual files and not the encrypted data.
At this point, you can read / write to the raw device or use the normal file system tools or run your program or Disk Warrior or Drive Genius to scavenge blocks as if the drive were a normal, non-FileVault 2 drive.
Trying to copy the encrypted raw blocks off the drive is futile without NSA / FBI level of funding, tools and know-how. There are people that do this professionally, but I'm not one of them. Also, since your drive isn't showing the normal "enter your password" to unlock dialog, it's not clear you can do anything but look for other copies of the data or get a quote from a professional data recovery service to see if they are willing to try to get things back.
Personally, if I had a FileVault drive that went bad, I'd probable just call up Kroll Ontrack or another professional firm and get a quote for their assistance. In the end, it would either be data I could restore from backup, write off as a loss, or pay $$$ to get back.