Recover deleted Encrypted OS X Volume

Question

I'm in the same situation as Recover deleted Encrypted OS X Extended volume

but the recovery process did not work, understand there still a potential way to fix this but I need to view part of the disk.

This is a big drive 24TB

After accidental FAT32 partition.

            0            1         PMBR
            1            1         Pri GPT header
            2           32         Pri GPT table
           34            6         
           40       409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
       409640         2008         
       411648  46874546176      2  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  46874957824         2015         
  46874959839           32         Sec GPT table
  46874959871            1         Sec GPT header

After attempted recovery

        start         size  index  contents
            0            1         PMBR
            1            1         Pri GPT header
            2           32         Pri GPT table
           34            6         
           40       409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
       409640  46874288048      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC
  46874697688       262144      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  46874959832            7         
  46874959839           32         Sec GPT table
  46874959871            1         Sec GPT header

Did not ask me for password and nothing shows up with diskutil cs list other than my main drive.

Attempted to comment on original post but do not have enough reputation.

These are the commands I used:

diskutil umountDisk /dev/disk2
sudo gpt destroy /dev/disk2
diskutil umountDisk /dev/disk2
sudo gpt create -f /dev/disk2
gpt add -b 40 -i 1 -s 409600 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B disk2
gpt add -b 46874697688 -i 3 -s 262144 -t 426F6F74-0000-11AA-AA11-00306543ECAC  disk2
gpt -r show /dev/disk2
gpt add -b 409640 -i 2 -s 46874288048 -t 53746F72-6167-11AA-AA11-00306543ECAC disk2

I did make one mistake when doing this the first time and did

gpt add -b 46874697688 -i 2 -s 262144 -t 426F6F74-0000-11AA-AA11-00306543ECAC  disk2

"-i 2" instead of "-i 3" could have this messed up the drive, I have a bin backup that I can restore from?

Any addition details would be helpful, I have the password to the encrypted volume.

There is a small chance that the sizes of i2 and i3 are slightly different than the ones you have chosen, that a gap exists between i2 and i3 and that the start block of i3 is at a lower block number. It would require remote access (e.g TeamViewer) and a root account though (because I have to search for special hidden metadata with an app called wxHexEditor) to check/repair this. Permuting the index numbers (i2 <> i3) is no problem! That's just a position in the GPT. — klanomath, Sep 29 '17 at 11:28

Recover deleted Encrypted OS X Volume

0 Answers0