Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've erased all contents in the boot partition of my Mac. I thought I had an up-to-date backup using TimeMachine, but unfortunately the home folder wasn't backed up at all, because it was encrypted using FileVault.

It seems that TimeMachine couldn't backup the home folder while I was logged in my account. It was my fault, I should have checked the backup before erasing the hard drive.

Is it possible to recover the data I lost? I know there are tools to recover files from an erased HFS partition. But, is it possible to recover files from a encrypted home folder that has been deleted?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

You need to try to recover the FileVault disk image; if you can get that back, you can mount it (though you need to supply your old login password to decrypt it). In Mac OS v10.3-10.4, the disk image was a single file; in v10.5, they switched to using a sparse bundle format, which breaks the image into a bunch of "band" files, and I'm pretty sure you need to get all of them (and arrange them into the appropriate sparsebundle directory structure) to make the image mountable. Here's the directory structure from my fvtest account (note that this is inside /Users/fvtest, but that doesn't matter for reconstruction purposes):

fvtest.sparsebundle/
    Info.bckup
    Info.plist
    token
    bands/
        0
        1
        2
        3
        37e5
        4
        5
        6
        d0
        d1
        d2
        d3
        d4

Note that each of the band files is around 8MB, so if this is an account with a significant amount of data in it, there'll be quite a few of them. The usual rules about data recovery apply, such as not writing anything to the disk until you're done recovering. Since OS X has really annoying habits about writing data to disks without being asked to -- spotlight indexes, for example -- it's best to mount the disk readonly if at all possible.

share|improve this answer
    
:O Wow! Seems pretty difficult to me! Anyway, thank you! –  Auron Sep 6 '09 at 22:02

The way FileVault seems to be implemented,
it should not be expected to get files deleted in this manner.
If it were possible, the security of your encryption scheme (FileVault itself) would be at stake.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.