Corrupted Data In Recovered/Encrypted DMG File

Question

This may be a conceptual issue, but I'm hoping someone may be able to point me in the right direction. I previously had an encrypted DMG file (exactly 500GB) that was created via Disk Utility with AES-128 encryption.

The .dmg was deleted from an external hard drive, and a few months later, recovered using Disk Drill. The file that was recovered is listed as the expected 500GB. The .dmg mounts successfully, via Finder or Terminal, when using the correct password, and the mounted image contains the expected folder structure. However, every individual file in the .dmg appears corrupted (it was mostly JPEG images and MOV files).

Each of the corrupted files lists a normal file size (I.E. 4MB for an image and 200MB for a video), but neither will successfully open in any application. A few .xml files can be opened, and contain portions of their original content, but are mostly gibberish.

Are there any suggested steps I can take to try to repair the issue? I was of the belief that since the .dmg was an encrypted image, its contents would remain intact, so as long as the original file remained intact. Since it mounts, I was hopeful.

Answer 1

When files are deleted depending on the filesystem, they remain as metadata but the actual data blocks used by the file are marked as free. During the time after which the file was deleted any other file operation can reuse those blocks and write there. When you fire up program that "undeletes" files, it will basically reassemble the file from the blocks that it used before deletion, looking up the available metadata. The file might look okay but there is no guarantee the contents will be the same as the original since some of the blocks might have been temporarily used by other files and then freed again. The only way to guarantee clean restore is if there were no other file operations after the deletion. In other words, immediately after you deleted the file. Even in that case your success might vary as modern OS-es constantly create and remove temp files, swap and other data.

Usually when you restore files after some time they will have parts from the original and parts that have been lost/altered.