Is it possible to recover a deleted FileVault sparse bundle in OS X?

Question

I made a huge noob mistake with my Macbook. I used Disk Inventory X to see why my drive was so full and it showed all my files under my user account as well as a huge amount of data in /Users/.myuseraccount called the sparsebundle. I had FileVault on but not Time Machine. I thought I might have used Time Machine to create an image of when I first got the computer, but I'm not sure if I did or not. It looked to me as if the data was completely separate files, but when I deleted the sparsebundle files, I could no longer log back into my account and now it shows my /Users/myuseraccount directory to be empty.

PLEASE somebody tell me I didn't just lose everything. Only a small amount of these files were backed up elsewhere. I cannot afford to lose all this. Is there disk recovery software that can restore this? Or could I possible take it back to the Apple store?

Answer 1

After speaking with tech support, I have determined that there is no way to recover these files. With the encryption of FileVault, there would be no way to tell what the files were.

Answer 2

Just went through the same problem and recovered all my files. I went down the same route, using a drive exprorer to identify large files and saw the sparsebundle, which I assumed was part of some virtual box software I had removed long ago. This locked me out of my computer until fixed the problem. I also deleted the directory it was in "/Users/.johndoe". Here is how you can recover your files and login. I will assume your username is johndoe, substitute your real username as needed:

Reboot computer holding apple + s which puts you in single user mode. Then type "mount -uw /" at command prompt to change the drive from read only to writeable. Then type "ls -a /.Trashes" to show all the deleted files. There should be a "johndoe.sparsebundle" file in there. Then "ls -a /Users". There should be a "johndoe" and a ".johndoe" directory. In my case I deleted the ".johndoe" directory as well, so I had to create a new one with "mkdir /Users/.johndoe". Now move the sparse back to whence it came "mv /.Trashes/johndoe.sparcebundle/ /Users/.johndoe". Now type exit which reboots the computer. Log in as normal, and enjoy.

Answer 3

Those files in the .sparsebundle folder were indeed your account. First: don't do anything on the computer until you've done what you can to recover the files -- everything that gets written to that disk has a chance of overwriting some of your data, so the fewer changes the better. See my answer to this question for more details.

I'm not up-to-date on the best software for recovering deleted files on Macs; anyone?