PDA

View Full Version : How to recover my FileVault-protected user files?


Jos
11-26-2007, 02:09 PM
My HD crashed on 11-18. Such is life. I've got two complete backups, or at least so I thought: one from Time Machine dated 11-9, and one from SD dated somewhere in October, before migrating to Leopard. I just now discovered that neither backup system is good friends with FileVault: I did not know that with FV activated, the backup needs to be done from a different, non-FV user. I wish Apple would have been more explicit about this, when you activate FV. And I must say that TM looses much of its attractiveness with FV activated. Will SD's Leopard version tackle this one?

As my TM backup is more recent, I tried to recover from this one first. After starting up from the Leopard DVD, I selected recovery from TM in the menu. The recovery apparently went fine, with my user coming up nicely on the login menu after restarting the computer, although without my picture, a first indicator that something was wrong. After entering the password, my user wouldn't open, and after entering the Master password, I was unable to change my user password. Not nice. I rebooted again with the Leopard DVD and reset all the passwords (to blank) for Guest, my old user and Master, using the password modification tool in the menu. After restarting, I now had three users: Guest, my old user and Other... I still could not open my old user. I opened the Guest user and was able to create a new user with administration rights. From this new user, I accessed the files of my old user in the Finder, after changing the rights to Read & write for all users, folder by folder. My old user turned out to be practically empty. Actually, the TM recovered Users folder was only a few MB. I guess I won't recover much more from here even if I could eventually break into my old user.

At least I completely recovered all the applications-with-purchased-licence-codes and all other system settings outside the Users folder. I decided to go on from here, updated to 10.5.1, and then entered my .Mac account. The sync brought back iCal, Address Book, Dock, Keychain, etc. And with the recovery of my Mail accounts (all IMAP), I recovered all my e-mail of the last 10 years or so. It took almost 24 hours to get there via ADSL, but in some way I recovered many documents as e-mail attachments, because I've sent or received them at some point in time. But still, it's not the same as having them neatly organised in folders in the Finder. And of course I didn't recover them all, e.g. pictures and music files.

So, I still wanted to recover my old user from my SD backup of October. And here's what happens: when I open the SD sparse image, the Users folder is (or appears to be) empty. Still, the folder weighs some 50 GB! Tricky. So with TinkerTool, I activated view hidden files and folders, and there appeared a new sparse image: my old user. Now, when I try to open it, my password is accepted: with another password, it says wrong password. Still, the sparse image won't open with the correct password: it shows an error.

I feel like Frodo in front of the closed gate to the Mines of Moria: I'm worried about what I'll find inside, but for now the gate remains closed...

What now? Maybe I need a hacker? Where do you find these people? Or maybe it's more simple? We're talking about 10 years work or so...

dnanian
11-26-2007, 02:12 PM
Have you tried actually starting up from the October backup?

Jos
11-26-2007, 04:28 PM
The backup is a sparse image. It was made on a network drive at work. Now I have on a FireWire drive at home, among other files. I can only restart from the HD or the Leopard DVD: the FW drive or the backup file don't appear as a possible startup drive.

I actually tried the Restore function, described in the SD manual, but it gave an error. I wouldn't like to do it again to see what the error said exactly, because I'd wipe out my HD again.

I have not tried Disk Warrior, have actually never used it...

dnanian
11-26-2007, 04:30 PM
What error does the image give when you try to open the FileVault user?

Jos
11-26-2007, 05:55 PM
The disk image you are opening may be damaged and could damage your system. Are you sure you want to open this disk image? Open / Don't Open.

Open => The following disk images failed to mount. User.sparseimage: no mountable file systems.

dnanian
11-26-2007, 06:00 PM
Sounds like the image is damaged, but this could be a Leopard problem, too.

Jos
11-26-2007, 06:08 PM
Disk Warrior is not yet fully Leopard compatible. The website says DW can't rebuild FileVaults or disk images when running under Leopard. I have no computer with Tiger.

What now?

dnanian
11-26-2007, 06:10 PM
Perhaps you can start up from a Tiger DVD and run Disk Utility on the image from there.

Jos
11-27-2007, 04:26 PM
Finally I was able to recover my old FileVaulted-user from my Tiger SuperDuper! backup. The Users folder in that backup seemed empty but weighed many GB. TinkerTool then revealeded a new sparse image in the Users folder, with my old user. I couldn't open it from there, as explained earlier. But I copied it out of the backup sparse image onto my FireWire drive, and then to my new hard disk. From there, I could open the user sparse image, after entering the old master FileVault password. One last thing: at some point, when I was recovering some files, the computer crashed (kernel panic). After running repair privileges in Disk Utility, I could no longer open the user sparse image. I guess the Leopard Disk Utility screwed the Tiger File-Vaulted sparse image. But after copying it again from my FireWire drive to my HD, I could open it again and continue to recover the remaining files. Thanks, SD!

dnanian
11-27-2007, 04:30 PM
Phew! Glad you were able to get it done!