Mac OS is not so much my area of expertise, I'm much more familiar with windows.
There is a MacBook that is clearly well used from the physical appearance however it opens at the fresh setup screen, it appears OS X was reinstalled at some point and the computer reset to out of box format.
How does Mac actually work when it's reformatted/reinstalled? Is the deleted data moved to unallocated space and can then be recovered? Or is it encrypted and when OS X is reinstalled it deletes the encryption key so the old data becomes unusable anyway?
Disk encryption is an option on Mac. If the drive was encrypted previously, then a reinstall should have wiped everything out.
The file table on Mac is more complicated than on FAT or NTFS so your odds of recovering deleted files is lower. With a reinstall or reformat, the file table should be created anew so I don't think you'll be able to find anything in the file table that's usable. It doesn't hurt to analyze the drive and confirm this though. I'm not sure how Mac appears after a reinstall versus when an account is removed and/or a new one is used to log in. You may also find that there was more than one partition.
If the drive was not encrypted, you may still be able to carve files.
You mean with Filevault?
You mean with Filevault?
Yes.
In fact Filevault is still enabled protecting the disk, it's only because the password is very simple I can get passed it and see that it's at the fresh set up screen from reinstall.
Does that change anything?
There is probably nothing that you can recover. Everything that existed before the current installation and FireVault setup should be gone.
If someone else has ideas otherwise, please chime in.