I have a problem which I think is unsolvable, however from related posts it does seem like there might be a remote chance... My situation:
I keep a regular Time Machine archive backed up to five external drives, 1, 2 and 3 are identical Seagate 2TB drives and also contain around 700gb of identical static data (work and documents amassed over the last 30 or so years that is not needed day to day)
Drives 4 & 5 are 1TB and contain just the daily working Time Machine archive. All disks were created through Disk Utility and formatted to Encrypted Mac OS Extended and all share the same encryption key (This has been performed on 10.13 if that has any bearing)
For complex reasons, drives 1, 2, & 3 have all been erased via Disk Utility to non-encrypted Mac OS Extended (Journaled) The erase process on each disk took a few seconds so I am confident that the encrypted data is still physically on the disk.
After this happened the disks were unplugged and no further data written to them. If it has any bearing, the erase operation happened on 12.4 (Monterey)
Guess what, that 700gb of static data was only stored on those 3 disks, and I need it back.
From my limited understanding of the situation it is almost certainly unsalvageable, however one does live in hope so I wanted to see if there was any approach I could try?
I am reasonably computer literate, but this is a new area for me. Is my only option to perform recovery work on the actual disk or should I try making a disk image via something like dd? (I've never done this before so have no idea if its a literal block for block copy of the entire disk)
This is the output of gpt on one of the three disks that were wiped (all give an identical output):
/dev/disk2 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *2.0 TB disk2
1: EFI EFI 209.7 MB disk2s1
2: Apple_HFS backup03 2.0 TB disk2s2
start size index contents
0 1 PMBR
1 1 Pri GPT header
2 32 Pri GPT table
34 6
40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
409640 3906357344 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC
3906766984 262150
3907029134 32 Sec GPT table
3907029166 1 Sec GPT header
Am I being naive to think that by remaking index 2 to be type 53746F72-6167-11AA-AA11-00306543ECAC (Core Storage container, including HFS+ FileVault)
and by creating a third index of type 426F6F74-0000-11AA-AA11-00306543ECAC (recovery partition) between blocks 3906766984 and 3907029133 (so size 262150) I might stand a chance?
Or is there some data associated with File Vault operation that is stored in another part of the disk which may have been deleted in the erase operation?
What I think the disk looked like prior to the erase:
/dev/disk2 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *2.0 TB disk2
1: EFI EFI 209.7 MB disk2s1
2: Apple_HFS backup03 2.0 TB disk2s2
start size index contents
0 1 PMBR
1 1 Pri GPT header
2 32 Pri GPT table
34 6
40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
409640 3906357344 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC
3906766984 262150 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
3907029134 32 Sec GPT table
3907029166 1 Sec GPT header
Apologies for the formatting of the disk info data, any help or guidance would be greatly appreciated!
Asked by UncleIra
(1 rep)
Feb 6, 2025, 06:43 PM