Need help decrypting after disk failure

Started by lance10t, July 11, 2013, 07:14:17 AM

Previous topic - Next topic

lance10t

I recently had the misfortune of having to reinstall Mountain Lion on my Mac, and had forgotten to copy out the decrypted contents of my Espionage 3 encrypted folders.  I am now having problems retrieving the data on my encrypted folders, and would really appreciate any help as those encrypted documents really mean a lot to me.

Some background on my setup, and what happened.

I have two physical disks on my iMac, with another Thunderbolt storage.  I have created the following encrypted volumes (slightly fictitious path names).

1.  /Volumes/Data/Protected - sparsebundle on /Volumes/Data/Protected.sparsebundle
2.  /Volumes/Thunderbolt/Encrypted/Folder1 - sparsebundle on /Volumes/Thunderbolt/Encrypted/Folder1.sparsebundle

I only remembered (to my horror) after the reinstallation that I had not decrypted and backed up the files first.  I trawled around the forum and took the advice of trying to restore the database3 file from ~/Library/Application Support/com.taoeffect.Espionage3.

I restored the database3 file into my current setup, and there were good news and bad news.

Good news - I managed to see the "Protected" folder in the folder list.
Bad news - I still could not see the "Folder1" folder, and I had no way of mounting "Protected".

Looking at the timestamps, I saw that Protected was created on 20 June 2013, while Folder1 was created on 22 June 2013.

The database3 file was dated 20 June 2013, and there was nothing newer than that in the Backup folder.  For some reasons, the new sparsebundle files created did not contain Folder1.

Though I can see the "Protected" folder in the list, I am not able to decrypt it.  I get the error "Critical Alert - Failed to unlock "Protected" ...... hdiutil: attach failed - Authentication error".

Even though an option was given to save the file, with the password copied out, it still did not work.

1.  Am I doing something wrong here for the "Protected" folder?
2.  Is there still a way to recover the contents of "Folder1" in this situation?

Any help will be very much appreciated!

zsolt

Hello, thanks for your very detailed description. I would suggest a remote session tomorrow where we can look into this together. I'm gmt+2 time, which time would be suitable to you

Rgds
Zsolt
Follow @espionageapp on twitter for news! | For general Mac support, please visit Mac Me Support

lance10t

Hi,

I am at GMT +8, and if you can do late afternoon your time (i.e. around 10 pm my time, 4 pm your time) that would be great?

I'm going to be on the road now, so my response may be delayed.

Cheers!

zsolt

That should work, just mail me to taoeffect@macmesupport.com an hour before you want to start.

Thanks
Zsolt
Follow @espionageapp on twitter for news! | For general Mac support, please visit Mac Me Support