Recovering data on hardrive with Filevault.

My parents had my old iMac. Unfortunately they were not backing it up and somehow filevault was enabled. Is there anyway to recover this data? The local guys did not think they could do this. She really only wants her old pictures. I am not sure what is wrong with the computer if that makes a difference. I seem to remember it was a problem with the screen going out.


Thanks for any help.

iMac

Posted on Jan 16, 2012 1:43 PM

Reply
4 replies

Jan 17, 2012 7:10 PM in response to appleuser12345

If the harddrive is still good, you should get an external drive enclosure and place the old drive in it. Your going to have to figure out what harddrive you have in the machine -- PATA or SATA.


Give tham a call.

User uploaded file


http://www.macsales.com/


There are professional recovery experts. They will be expensive.


You need to follow this procedure to recovering a filevault id.


Mac OS X 10.3, 10.4: FileVault - How to verify or repair a home directory image ...


http://support.apple.com/kb/HT2631?viewlocale=en_US





*How filevault saves your home directory*
When you are not logged in, the sparse image is not hidden. It is:
/Users/yourshortusername/yourshortusername.sparseimage


In the finder, you click on Go
then click on Go to folder.
then type in the path. example
/Users


Macintosh-HD -> Applications -> Utilities -> Terminal


# To find out the users on the system type, use the list command. The l is a lower case L:
mac $ ls -l /Users
total 0
drwxrwx--- 3 root admin 102 May 10 2004 Deleted Users/
drwxr-xr-x 11 filevaul a 374 Aug 10 2008 a (Deleted)/
drwxr-xr-x 12 filev filev 408 Jun 21 2009 filev/
dr-x------ 3 filevaul filevaul 102 Jan 23 15:55 filevault/
drwxr-xr-x 5 root wheel 170 Jul 22 2008 ftp/
... clipped ...

### User filevault is not logged in
Your administration password when typed will not appear.

mac $ sudo ls -la /Users/filevault/
Password:
total 98560
dr-x------ 3 filevaul filevaul 102 Jan 23 15:55 .
drwxrwxr-t 23 root admin 782 Jan 23 16:13 ..
-rw------- 1 filevaul filevaul 50458624 Jan 23 16:13 filevault.sparseimage
mac $

### User filevault has logged in
Mac OS moves the sparseimage to a hidden file in the users directory.
sudo ls -la /Users
total 32
drwxrwxr-t 24 root admin 816 Jan 25 13:59 ./
drwxrwxr-t 50 root admin 1802 Dec 31 1969 ../
-rwxrwxr-x 1 mac admin 12292 Jan 23 20:13 .DS_Store*
dr-x------ 3 filevaul filevaul 102 Jan 23 15:55 .filevault/
dr-x------ 3 fv fv 102 Nov 15 20:01 .fv/
-rw-r--r-- 1 root wheel 0 Mar 20 2005 .localized
... clipped ...
mac $sudo cd .filevault
mac $pwd
/Users/.filevault
mac $sudo ls -la
total 100608
dr-x------ 3 filevaul filevaul 102 Aug 31 12:41 ./
drwxrwxr-t 25 root admin 850 Aug 31 12:41 ../
-rw------- 1 filevaul filevaul 51507200 Aug 31 12:43 filevault.sparseimage
mac $


mac $ sudo ls -la /Users/filevault/
total 24
drwx------ 15 filevaul filevaul 612 Jan 23 16:03 .
drwxrwxr-t 24 root admin 816 Jan 23 16:03 ..
-rw-r--r-- 1 filevaul filevaul 3 Jan 23 15:50 .CFUserTextEncoding
-rw-r--r-- 1 filevaul filevaul 6148 Jan 23 15:54 .DS_Store
drw------- 7 root filevaul 238 Jan 23 16:03 .Spotlight-V100
drwx------ 2 filevaul filevaul 68 Jan 23 16:03 .Trash
d-wx-wx-wt 2 root admin 68 Jan 23 15:55 .Trashes
drwx------ 5 filevaul filevaul 170 Jan 23 15:55 Desktop
drwx------ 3 filevaul filevaul 102 Jan 23 15:50 Documents
drwx------ 20 filevaul filevaul 680 Jan 23 15:54 Library
drwx------ 3 filevaul filevaul 102 Jan 23 15:50 Movies
drwx------ 3 filevaul filevaul 102 Jan 23 15:50 Music
drwx------ 4 filevaul filevaul 136 Jan 23 15:50 Pictures
drwxr-xr-x 4 filevaul filevaul 136 Jan 23 15:50 Public
drwxr-xr-x 5 filevaul filevaul 170 Jan 23 15:50 Sites
mac $

Jan 18, 2012 4:37 PM in response to rccharles

Thanks for the response. I guess I should try to have my mother send me the HD, as I am confident she would not be able to do that. When you say there are professional recovery experts, will they all be able to recover files even through filevault? I assume that they will need user info (name/password), as at least from my understanding filevault uses a very secure encryption. But from the sound of it, my best shot (with minimal initial investment) might be just to get an external enclosure and use terminal to access the files. Thanks again. Will report back as I try this.

Jan 20, 2012 10:46 AM in response to appleuser12345

Good luck. doing it yourself will be a lot cheaper.



Perhaps Disk Warrior will be of some help:

http://www.alsoft.com/DiskWarrior/


"Stellar Phoenix Macintosh - Mac data recovery software, recovers data from damaged, deleted, or corrupted volumes and even from initialized disks."

They have a trial version, so I guess you can see if your data can be recovered...

http://www.stellarinfo.com/mac-data-recovery.htm


"Data Rescue II is the best data recovery software on the market for recovering files from a problem hard drive. Data Rescue II works when other tools fail. Data Rescue II is also completely safe to use since it does not attempt any risky repairs to the drive while its scanning."

http://www.prosofteng.com/products/data_rescue.php


FileSalvage is an extremely powerful Macintosh application for exploring and recovering deleted files from a drive or volume. FileSalvage is designed to restore files that have:

-- been accidentally deleted.

-- become unreadable due to media faults.

-- been stored on a drive before it was re-initialized/formatted.


http://subrosasoft.com/OSXSoftware/index.php?main_page=product_info&products_id= 1


"TestDisk is a free data recovery utility. It was primarily designed to help recover lost data storage partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally erasing a partition table)."

http://en.wikipedia.org/wiki/TestDisk



-----

"*Hard drive data recovery and warranty implications*


Hard drives that have become non-functional through normal use, and have had data recovery performed on them by DriveSavers or Ontrack Data Recovery can be returned to Apple for warranty service. This includes products covered by the AppleCare Protection Plan. The cost of any data recovery attempts is not covered by the Apple Limited Warranty."

http://support.apple.com/kb/HT3974?viewlocale=en_US



Entering:

mac data recovery

into Google will list some firms who specialize in recovering data. Data recovery isn't cheap.


Examples:

1) Ontrack Data Recovery is the world leader in data recovery services and data recovery software offering the fastest, most convenient and cost-effective solutions to clients who have experienced data loss.

http://www.ontrackdatarecovery.com/


2) Enter the world of DriveSavers Data Recovery…

* Data Recovery Tools

* Data Recovery Process

* Data Recovery Cleanroom

http://www.drivesavers.com/


"Encryption: DriveSavers engineers have been trained and certified by leading encryption vendors, such as GuardianEdge, Utimaco Safeguard, PGP and PointSec, to safely recover file-level and disk-level encrypted data"

http://www.drivesavers.com/recovery-services/encryption/

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Recovering data on hardrive with Filevault.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.