URGENT HELP!! FileVault and Sparse Image

[raquiros]

Ok.... I was working on Saturday trying to free up some space on my MacBook Pro and I found a file around 75GB located on /users/raquiros/raquiros.sparseimage

At first I didn't know what was the file for, so I decided to google to see whether it was safe to delete that file or not.... UNFORTUNATELY I found a stupid answer on a forum that said that if Time Machine was not enabled (which was my case) there was no need to have that file and it was safe to delete it.

I was logged in as my user "raquiros" and I moved the file to the trash.... then I went ahead and started to empty my trash bin..... at a certain point it gave me an error saying that whatever file could not be deleted because it was in use and it was when I scared myself.

After that error I noticed that the raquiros.sparseimage file in the bin was now like 120MB, obviouslly the files in use weren't deleted... so I when ahead and tried to access my documents and couldn't find any... that's when I realized that I screwed my whole data and that the sparse image was being used for FileVault.

I then tried to run Data Recovery II looking for the raquiros.sparseimage file, but I couldn't find it... then I figured out that it wouldn't find it because the file was actually not deleted at all... just the contents that weren't in use at that time (most of it).

Right now I can't login as my user.... I am logged in as root and I have the raquiros.sparseimage file with what it had in the bin..... my guessing is that I have to start looking in data recovery for the files that were inside the sparseimage to put it back.... but I'm having trouble finding that....

I would appreciate some advise, unfortunately I didn't make any backup... good lesson but I need to get my files back!!

PLEASE HELP!! is all my work!!

 

[Guiyon]

Sorry to say, but more than likely you are out of luck. The sparseimage is encrypted (the whole point of FileVault) so any left-over data on the drive is going to be indistinguishable from random data; since the whole basis of file recovery utilities is going to be searching for known patterns (ie: Word documents, images, etc) it will either return a false positive or ignore it. In addition, if the image is not recovered in it's entirety the system may not be able to decrypt it.

 

[raquiros]

Sorry to say, but more than likely you are out of luck. The sparseimage is encrypted (the whole point of FileVault) so any left-over data on the drive is going to be indistinguishable from random data; since the whole basis of file recovery utilities is going to be searching for known patterns (ie: Word documents, images, etc) it will either return a false positive or ignore it. In addition, if the image is not recovered in it's entirety the system may not be able to decrypt it.

I actually don't want to decrypt the data... just need to recover the deleted files to put them back in the folder.... when that's done I can login back with my user and my password.... so I guess no decryption should be required... I just need the files part of the raquiros.sparseimage file, not to recover the lost data as well....

 

[Guiyon]

I actually don't want to decrypt the data... just need to recover the deleted files to put them back in the folder.... when that's done I can login back with my user and my password.... so I guess no decryption should be required... I just need the files part of the raquiros.sparseimage file, not to recover the lost data as well....

That is the point; that entire sparse image (including all files contained within it) is encrypted data. If Apple is doing their deletions properly, the data is not recoverable.

 

[raquiros]

I ended up erasing the hard drive and reinstalling OS X. I'm afraid I lost all the info and will have to start again....

I will have to learn how to use the backup tools for further accidents.

Thanks everyone