1

Is there a possibility to recover a 2TB APFS partition that has been altered by a fomatting command to a new 2TB APFS partion (i.e. the real data has not been deleted, encryption password is knonw, even parts of the encrypted data is available as backup).

I tried the approach discussed in Recover deleted Encrypted OS X Extended volume, but it did not work.

Nimesh Neema
  • 51,809
Chris
  • 11
  • 2
    I've never worked with recovering encrypted volumes, but have you tried an app like Data Rescue? You might want to contact that company, it will likely be a pretty straight forward "yes" or "no". – l008com Jun 05 '18 at 08:08
  • 1
    I tried several tools but they did not work as required, e.g. searching for deleted files or stating that the volume has no issues (which is correct for the new volume but I need to recover the previous volume). The article I linked above would be fit for purpose except for the fact that it refers to re-format with FAT and not to HFS+/APFS and that's why the required information to restore the GPT is not available in my case as described. But maybe there is another possiblity to recover the original disc structure. – Chris Jun 05 '18 at 08:21
  • 1
    If you have overwritten any part of the first few bytes, where the real encryption key resides, then no. You should restore from backup. – Andrea Lazzarotto Jun 05 '18 at 12:56
  • Well, I have formatted the drive with the exact same filesystem type, thus I assume those bytes are overwritten. Is there any area on the disk, where I could find a backup of the real encryption key that has not gotten overwritten by an initial format (as the existing backup is not complete, I would need access to the overwritten volume)? – Chris Jun 05 '18 at 13:12

0 Answers0