Recover accidentally reformatted encrypted HFS+ volume

encryptionformattinghfs+ssd

On my Mac I have an internal SSD divided in 2:

encrypted HFS+, case-sensitive, journaled volume:

noether 1 250 Go
noether 2 250 Go

Last night I mistakenly formatted the 2nd volume with Disk Utility:

noether 2 250 Go

as an:

not encrypted HFS, case-sensitive, not journaled.

This formatting took just a few seconds. Since this error, this volume remains unmounted. I have a backup but I need files which are more recent than this backup.

Is there any method, even complex using command line, to recover the CoreStorage volume, and the contained encrypted volume associated with my previous:

noether 2 250 Go

Here is the result of a useful command:

••My__Mac•• % diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.3 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:          Apple_CoreStorage noether 1 250 Go        249.6 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
   4:                  Apple_HFS noether 2 250 Go        249.6 GB   disk0s4

/dev/disk1 (internal, virtual):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS noether 1 250 Go       +249.2 GB   disk1
                                 Logical Volume on disk0s2
                                 2C0A9DD8-7507-4553-A7AA-C2BDE11104C1
                                 Unlocked Encrypted

••My__Mac•• %

Best Answer

In this case you should recover the disk contents from backups.

The format command will have overwritten (small) parts of the disk, so in order to get everything back, you'll want to recover from backups.

If you haven't got backups, you will need to try changing the partition table to indicate it is a CoreStorage volume and then attempt to manually edit enough of the partition to ensure that it can be mounted (if possible at all). As the partition was encrypted, this will probably prove to be very difficult, if possible at all.

Related Question