Is it possible to recover deleted files from a home folder encrypted with FileVault?

Question

I've erased all contents in the boot partition of my Mac. I thought I had an up-to-date backup using TimeMachine, but unfortunately the home folder wasn't backed up at all, because it was encrypted using FileVault.

It seems that TimeMachine couldn't backup the home folder while I was logged in my account. It was my fault, I should have checked the backup before erasing the hard drive.

Is it possible to recover the data I lost? I know there are tools to recover files from an erased HFS partition. But, is it possible to recover files from a encrypted home folder that has been deleted?

Answer 1

You need to try to recover the FileVault disk image; if you can get that back, you can mount it (though you need to supply your old login password to decrypt it). In Mac OS v10.3-10.4, the disk image was a single file; in v10.5, they switched to using a sparse bundle format, which breaks the image into a bunch of "band" files, and I'm pretty sure you need to get all of them (and arrange them into the appropriate sparsebundle directory structure) to make the image mountable. Here's the directory structure from my fvtest account (note that this is inside /Users/fvtest, but that doesn't matter for reconstruction purposes):

fvtest.sparsebundle/
    Info.bckup
    Info.plist
    token
    bands/
        0
        1
        2
        3
        37e5
        4
        5
        6
        d0
        d1
        d2
        d3
        d4

Note that each of the band files is around 8MB, so if this is an account with a significant amount of data in it, there'll be quite a few of them. The usual rules about data recovery apply, such as not writing anything to the disk until you're done recovering. Since OS X has really annoying habits about writing data to disks without being asked to -- spotlight indexes, for example -- it's best to mount the disk readonly if at all possible.

Answer 2

The way FileVault seems to be implemented,
it should not be expected to get files deleted in this manner.
If it were possible, the security of your encryption scheme (FileVault itself) would be at stake.