Jump to content

Help! Recovering accidenly deleted files from FileVault


battista
 Share

2 posts in this topic

Recommended Posts

I accidently deleted important files and trashed them normally (non secure).

 

These files were on a /home subfolder in an activated FileVault.

 

How can I recover these files with UnErase tools or Pattern Seach tools under MacOS Leopard?

What tools should I use?

 

Or is there a way to open/mount and access the sparseimage files as loopbacks under linux?

 

Please recommend possible ways to handle the recovery.

 

Is it possible to redirect the mounted uncrypted (?) sparseimage on disk1s2 into some file using dd ? Would this represent the unencrypted /Users/(username) partition?

Link to comment
Share on other sites

Hi,

 

You could try TestDisk http://www.cgsecurity.org/wiki/TestDisk or PhotoRec http://www.cgsecurity.org/wiki/PhotoRec which scans your entire hard drive and search for files types based on their header. You'll most probably find your files back.

 

Note that you should really install the tool on another partition in order to write over the sectors occupied by your lost files !

 

read the doc carefully,

 

Good luck

 

Pagaille

Link to comment
Share on other sites

 Share

×
×
  • Create New...