FireVault Problems

D

dormarth

g33k
Evening folks,

I have been handed the hard drive from my friends broken G3 iBook and asked to pull the contents of her user folder off it.

Not a problem I thought I have just the caddy to do this, I then realised that she has been using FireVault to make sure that the contents of her hard drive stay safe.

So now when I try to look at the contents of her user folder all I can see nothing. I have tried to remove the permissions from the drive but this has not worked.

Does any one know of a way for me to view the contents of her folder or is it lost for all time since the hardware is well and truly dead?

Cheers
 
You should find that in her user directory there are none, or (usually) only a couple of folders, plus the Filevault encrypted disc image, which will be named something like Username.sparseimage (an expanding and contracting disc image format that contains the bulk of her home directory contents). Ask your friend to either provide you with her password for this, or to enter it herself when you attempt to mount this image. You will then see her home directory contents within it, and be able to copy the files out of it to a new location.

I would also suggest to your friend that she also back up her home directory in future. A perk of using Filevault is that you can simply back up that one single large sparseimage file to DVD, as opposed to thousands of little ones with fiddly Unix and hidden files that can be a hassle when backing up an unencrypted Apple Home directory.
 
JeffCGD said:
You should find that in her user directory there are none, or (usually) only a couple of folders, plus the Filevault encrypted disc image, which will be named something like Username.sparseimage (an expanding and contracting disc image format that contains the bulk of her home directory contents). Ask your friend to either provide you with her password for this, or to enter it herself when you attempt to mount this image. You will then see her home directory contents within it, and be able to copy the files out of it to a new location.
Click to expand...

Morning,

I have the password for the account that she was using but I can't see the sparseimage showing. Is it going to be a hidden image?
 
Her Filevault protected home directory (name.sparseimage) could be hidden, but I think that they are usually visible in the MACHINENAME-->USERS--> folder, as long as you are not logged into that account.

You can try a search for hidden files with .sparse or .sparseimage in the filename, just in case.

The other reality might be that the drive is just seriously poked, and that the data is lost, or will need more intensive data recovery tools (Discwarrior, Techtool Pro, or Data RescueX).

Good luck buddy :)
 
Try goto /Users/.HER_USERNAME

Note the . before the username.

It is a hidden directory though... I am not sure how to see hidden directories in Finder... but you can see it in the terminal by:
ls /Users/.HER_USERNAME

Edit: Actually, in Finder, if you just press Apple+Shift+G; and type in /Users/.HER_USERNAME; then you should see that disk image thing.
 
Morning Folks,

I used Oynx to show me all hidden files on my machine then found the directory in question. All the data has been moved over to both my machine and a CD-R.

Thanks for your help.

:)
 
You must log in or register to reply here.
Back
Top