I accidentally used macOS to format an SSD that was encrypted with VeraCrypt. Is it possible to recover the VeraCrypt headers?
I used VeraCrypt to encrypt a complete SSD. Well, not totally. It was initialized as a GPT drive under Windows 7. Hence, there is a 128MB EFI partition at the beginning of the SSD. The remainder ist filled with one partition that was encrypted.
I deleted the SSD when I accidentally initialized it as a GPT drive in macOS.
VeraCrypt stores the header with the master key at the beginning of the encrypted partition. A copy of the header is stored at the end of the partition as a backup.
Problem 1: GPT drives store a copy of the GPT at the end of the drive as backup. The backup VeraCrypt header is, therefore, gone.
When initializing a GPT drive, macOS creates a 200MB EFI partition followed by a standard partition using the rest of the drive. Since my header was stored at 128MB, it should be fine. The GPT ist stored at the beginning of the drive (and a backup copy at the end) and no further data is written.
Problem 2: macOS decided to overwrite the beginning and the end of the drive with zeros. So many, in fact, that my header at 128MB is also gone. I had hoped that the area of the partition would just be marked as empty but the actual data would still be there. Alas, a dd clone of the whole SSD revealed just zeros at 128MB.
Which brings me to the initial question: If an area on an SSD is overwritten, is there any way to recover the overwritten data? I know that simple overwriting is permanent as the cells will get different charges and the previous charges are gone (in contrast to magnetic hard drives where traces of the previous magnetization remain).
But: May it be possible that the concerned cells were not overwritten at all and marked as not to be used by the SSD’s wear leveling? Is it possible to read those cells and retrieve the previous data? And if so, to reconstruct the overwritten data blocks that were comprised of these cells?
Any help or insight is greatly appreciated. Half of my life is stored on that SSD.