There was an iMac with a single HDD with full-disk FileVault encryption enabled. Some "sysadmin" with a questionable proficiency tried to access data without neither a FileVault password, nor a required knowledge and rendered the disk invalid.
From scarce and sporadic explanations he gave, it may be assumed he messed the disk structure with some HEX editor, however it is known that use of such tools will mess CRC32 checksum, what even Wikipedia clearly states. Supposedly that is what is happened.
So what we got now is a disk without any partitions at all:
imac:/ a$ sudo gpt -r show /dev/disk1 start size index contents 0 1953525135 1953525135 32 Sec GPT table 1953525167 1 Sec GPT header
So only what is left are secondary GPT table and header.
gdisk clearly states that primary GPT is corrupted and offers to restore it from a backup, but the restored partition structure looks odd:
imac:/ a$ sudo gdisk /dev/disk1 GPT fdisk (gdisk) version 1.0.1 Caution: invalid main GPT header, but valid backup; regenerating main header from backup! Caution! After loading partitions, the CRC doesn't check out! Warning! Main partition table CRC mismatch! Loaded backup partition table instead of main partition table! Warning! One or more CRCs don't match. You should repair the disk! Partition table scan: MBR: not present BSD: not present APM: not present GPT: damaged Found invalid MBR and corrupt GPT. What do you want to do? (Using the GPT MAY permit recovery of GPT data.) 1 - Use current GPT 2 - Create blank GPT Your answer: 1 Command (? for help): p Disk /dev/disk1: 1953525168 sectors, 931.5 GiB Logical sector size: 512 bytes Disk identifier (GUID): D5FB3C42-0E3D-4DC5-B4A9-7C97E8704CF5 Partition table holds up to 128 entries First usable sector is 34, last usable sector is 1953525134 Partitions will be aligned on 8-sector boundaries Total free space is 1953262957 sectors (931.4 GiB) Number Start (sector) End (sector) Size Code Name 1 34 262177 128.0 MiB 0C01 Microsoft reserved ... Command (? for help):
And here is
imac:/ a$ fdisk /dev/disk1 Disk: /dev/disk1 geometry: 121601/255/63 [1953525168 sectors] Signature: 0x2A74 Starting Ending #: id cyl hd sec - cyl hd sec [ start - size] ------------------------------------------------------------------------ 1: ED 813 202 27 - 321 220 54 [ 783900958 - 3581756343] <Unknown ID> 2: 7C 724 235 26 - 550 178 18 [1238663544 - 3274878647] <Unknown ID> 3: F6 189 250 53 - 993 151 48 [2185613635 - 893877749] <Unknown ID> 4: 2E 201 236 53 - 683 56 37 [ 23839636 - 1903113077] <Unknown ID>
Quick search by
testdisk revealed two primary partitions, the first is of type
MS Data, previously also detected by
gdisk, but seems like it is the second, which may be of interest, since it is of a type
Mac HFS and its size of roughly 650 MB indicates it is missing Recovery HD. So now I need to find boundaries of the main FileVault-protected data partition:
Partition Start End Size in sectors P MS Data 1699755823 1702272435 2516613 [ M-:?->M-'` P^C ] P Mac HFS 1952255592 1953525127 1269536
testdisk's Deeper Search, unfortunately haven't found any big partitions:
The question is it is even possible to restore partitions structure from the secondary GPT table/header? I assume that if these are present, there may be some use of them. And what else I can try to retrieve the location of the main data partition?