Accidentally overwrote encrypted external drive (Mac OS)

by Adam Barrow   Last Updated May 15, 2019 15:12 PM

So I was rushed (and being careless) and accidentally copied about 80 MB of a Raspberry PI image (SD card formatted extfs) over my external USB drive (4TB) that was formatted and encrypted (using Disk Utility but not sure of the specifics).

I tried following Recover deleted Encrypted OS X Extended volume and looked through Rebuild partition table on external HDD - not writable but still haven't managed to get the drive recognizable by my laptop (Mac OS 10.13.6 - where the drive had been mounted previously).

Running TestDisk did find these partitions (I assume from the backup GPT?) before I started making any changes:

#1557837238 Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 7814037167 sectors
 1 : start=       40, size=   409600, Id=00, P
 2 : start=   409640, size=3518398048, Id=00, P
 3 : start=3518807688, size=   262144, Id=00, P

(Note that I think the sizes may be incorrectly reported as I didn't change the disk geometry before running the scan)

Following @klanomath's excellent instructions in the first answer above, I did recreate the partition table, so now gpt -r show /dev/disk2 does give:

       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640  7813365343      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC
  7813774983      262144      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  7814037127           7         
  7814037134          32         Sec GPT table
  7814037166           1         Sec GPT header

However, diskutil cs list still reports No CoreStorage logical volume groups found.

I'm unfortunately out of my element here and not sure how to proceed.



Related Questions



CoreStorage logic volume failed to mount

Updated September 01, 2017 07:12 AM


Can't mount encrypted HFS volume

Updated February 19, 2018 17:12 PM