Mac Data Recovery

Guide to Recover Data from an Encrypted Mac Hard Drive

Written By Vishal
Approved By Rohit Arora
Updated on 5 Aug, 2024
Min Reading 8 Min
Share

Table of Content

Summary: Hard drive encryption is a useful utility on Mac that helps users password-protect their confidential data on the system or an external hard drive. Sometimes, an encrypted hard drive becomes inaccessible & malfunctions due to logical errors. In this blog, learn how to encrypt & decrypt an external hard drive or the native disk drive on Mac. Also, get a guide to recover data from a malfunctioning or inaccessible encrypted hard drive.

Free Download100% secure

Drive encryption in Mac allows users to secure confidential data from unwanted access or theft. Users can enable drive encryption on a Mac’s native disk drive and external storage drives like HDDs, SSDs, etc.

The only way to decrypt an external Mac hard drive and access its data is to enter the decryption key. Without it, you won’t be able to access or recover your data from an encrypted Mac hard drive/solid state drive.

Let’s dive in to learn more about Mac disk drive encryption & decryption in detail.

What is Mac Hard Drive Encryption?

macOS offers FileVault – a built-in feature to encrypt native Mac disk drives and external hard drives to protect your data from prying eyes, thefts, and hackers. FileVault full-disk encryption (FileVault 2) uses XTS-AES-128-bit encryption with a 256-bit key to help prevent unapproved access to the information on your startup disk.

How to Encrypt and Decrypt Mac Hard Drive?

macOS has several native methods to encrypt and decrypt a Mac hard drive. The following sections illustrate the methods in detail. We will also look at how to recover data from an encrypted or corrupt Mac hard drive.

Method 1: Encrypt or Decrypt Mac hard drive using Finder

macOS Finder allows you to encrypt or decrypt your internal or external Mac hard drive and volume quickly.

Encrypt a Storage Drive using Finder

To encrypt your Mac hard drive by using Finder, perform the following steps –

Use the internal Mac volume or connect the external storage drive you wish to encrypt.
Launch Finder, and from the left pane, secondary-click a drive or volume and select the Encrypt ‘Drive_Name’ option.

Set a password and hint as requested by macOS. Wait until the hard drive encrypts. From now on, you need to key in the password to unlock the drive.

Similar to encrypting a hard drive, macOS Finder also makes the process of decryption easy.

Decrypt a Hard Drive Using Finder

Open Finder, and from the left pane, secondary-click on the encrypted hard drive and select the Decrypt ‘Drive_Name’ option.
After decrypting the drive, access the hard drive directly without any password.

enter password to decrypt mac hard drive

Method 2: Encrypt or Decrypt Storage Drive using FileVault

FileVault is the native disk encryption application that allows you to encrypt your startup disk. It uses your login password as an encryption key.

Encrypt your Mac hard drive using FileVault –

Go to Apple menu > System Preferences > Security & Privacy > FileVault tab.
Click the Lock icon and enter admin credentials. Click the “Turn On FileVault” button.
Provide a password to encrypt the disk. Your Mac encrypts the disk in the background. You can check the encryption progress from the FileVault section.
After encryption, restart your Mac and provide the login password to finish starting up.

turn on hard drive encryption on mac via file vault

Decrypt your Mac hard drive using FileVault –

Open the FileVault tab from Security & Privacy, as explained before. Click the “Turn Off FileVault” button. Your Mac decrypts the disk in the background. You can check the decryption progress from the FileVault section.
After decryption, restart your Mac. Now, you won’t need any password to unlock your Mac hard drive.

Method 3: Encrypt or Decrypt Storage Drive using Disk Utility

Disk Utility has the option to erase your Mac hard drive in an encrypted format—APFS (Case-sensitive, encrypted), Mac OS Extended (Journaled, Encrypted), or Mac OS Extended (Case-sensitive, Journaled, Encrypted).

Encrypt your Mac hard drive using Disk Utility –

For non-startup disks, launch Disk Utility from Finder > Applications > Utilities. Or else, press Command + Spacebar to bring Spotlight. Type disk utility and click the Disk Utility search result to launch the application.
From Disk Utility, select the internal non-boot Mac volume or the external hard drive you want to protect via password, and click the Erase tab.

Warning: Erasing a drive will remove all its content, so back up before performing the erase operation.

In the Format section, click the drop-down menu to select an encryption format.

In the Name section, provide your hard drive with a name and click Erase. Before macOS erases the drive, it displays a dialog box asking for a password.
Enter a password that is easy to remember yet difficult to crack for others. Don’t forget to provide a Password Hint. Disk Utility completes the erase process of your hard drive.

When the erase process is over, the encrypted drive mounts on the Mac. Enter the drive’s password each time you access it. If you forget the password, the drive will become inaccessible.

Encrypt Macintosh HD, the startup disk, using Disk Utility in macOS Recovery mode –

Start or restart your Mac immediately by pressing and holding the Command + R keys. Release the keys when the Apple logo appears. Your Mac boots into macOS Recovery mode.
From the macOS Utilities window, select Disk Utility and click Continue. Erase the startup disk in an encryption format after backing it up using Time Machine.
Reinstall macOS from the macOS Utilities window. Finally, restore the backed-up data from the Time Machine backup drive to the encrypted drive.

Disk Utility also lets you decrypt a Mac hard drive that you have erased using an encryption format.

Decrypt your Mac hard drive using Disk Utility –

Open Disk Utility, then select your encrypted storage drive.
To unlock the hard drive, go to File > Unlock ‘Drive_Name.’
Enter the password when prompted.
To decrypt the hard drive, go to File > Turn Off Encryption.

Method 4: Encrypt or Decrypt Storage Drive using Terminal

Terminal is a powerful application that can help you encrypt or decrypt your Mac hard drive. However, working with Terminal requires a complete knowledge of the Terminal commands, and any incorrect operation can result in data loss. So, back up your data from the drive before executing any Terminal command.

Encrypt a hard drive using Terminal –

Launch Terminal from Finder > Application > Utilities.
Type diskutil apfs list and hit Return. The Terminal produces a list of all APFS volumes and containers. Note down the APFS volume ID information.
To encrypt volume, type diskutil apfs encryptVolume /dev/apfs_volume_id and hit Return. Type the password for encryption when asked. Type again to confirm the password.
To monitor encryption progress, type diskutil apfs list and hit Return.

Similarly, you can decrypt your encrypted Mac hard drive by using Terminal.

Decrypt an APFS encrypted drive using Terminal –

Launch Terminal. Type diskutil apfs list and hit Return to know the APFS volume ID.
Type diskutil apfs unlockVolume /dev/apfs_volume_id -passphrase type_the_key, then hit Return to unlock the volume.
Type diskutil apfs decryptVolume /dev/apfs_volume_id and hit Return to decrypt the volume. Authenticate when prompted.
To monitor decryption progress, type diskutil apfs list and hit Return.

For other drives, do the following –

Launch Terminal and type the code diskutil cs list and hit Return. The Terminal produces a core storage list in a hierarchy. Copy the alphanumeric code that is logical volume UUID, which is next to Logical Volume Group.
Type diskutil cs decryptVolume logical_volume_uuid -passphrase type_the_key and hit Return.

But what if you delete few crucial files from an encrypted hard drive, or the drive itself turns corrupt. In such cases, you’ll need to find ways to recover your lost data.

Recover Data from an Encrypted Mac Hard Drive

Part 1: Recover Encrypted Mac Hard Drive using Time Machine

Mac data loss can occur from an encrypted hard drive due to accidental deletion, formatting, or corruption. So, setting up a Time Machine backup hard drive is a must.

Time Machine performs incremental backups of your encrypted Macintosh HD per the schedule. And in case of data loss, you can use Time Machine to restore the lost data to your Mac drive.

Steps to recover encrypted Mac hard drive with Time Machine –

Ensure your Time Machine backup drive is connected to your Mac. Launch Time Machine from the Launchpad.
Find the deleted or lost files by using Up/Down arrows or Timeline. Select the required files and folders, then click Restore. The files will restore to their actual location.

Part 2: Recover Encrypted Mac Hard Drive Data using a Mac Data Recovery Software

What if you haven’t set up Time Machine on your Mac or the configured Time Machine backup drive has become corrupt? In such cases, only reliable data recovery software for Mac like Stellar Data Recovery Professional for Mac can help you recover data from an encrypted hard drive.

Install Stellar Data Recovery Professional for Mac. Launch it.
On the first screen, select what you want to recover. By default, Recover Everything option is selected. Click Next.

launch stellar data recovery professional for mac

On the next screen, choose the Encrypted Volume. Enter the Password and click Continue.
Click Scan.

Notes –

If you fail to provide a passcode to unlock your encrypted hard drive, the software won’t proceed further to scan your encrypted drive.Once the drive is unlocked, re-select the drive, and you can either switch to Deep Scan or stick with the primary scan option at your convenience.

Once the scanning is completed, the software will list all the recoverable items. Preview the items.

recover data from encrypted mac hdd using stellar data recovery professional for mac

If you are satisfied after the preview, select the files for recovery. Click Recover and choose a place to save recoverable files.

Watch this video to learn how you can encrypt, decrypt, and recover data from an encrypted Mac hard drive.

Note – In case of a corrupt encrypted Mac hard drive, the software will perform RAW recovery on the physical drive. In such a scenario, the files names might look different. You can recover the desired files by previewing them one by one.

What if the Decryption Password is Lost?

If the decryption password is lost, the data on your encrypted Mac hard drive is lost forever. You won’t be able to retrieve it even with the help of a data recovery software. Therefore, keep the decryption key saved in a secure location to use when required.

Conclusion

Although macOS has made encrypting hard drives easy and convenient, one should be careful while doing it. A decryption key or password is required to access an encrypted device. Losing the decryption key can make the drive permanently inaccessible, and you may lose your data forever.

Therefore, you keep the decryption key of the drive safely and within your reach.

If you have the decryption key but still can’t access the data on the drive, you should use Stellar Data Recovery Professional for Mac to recover data from an encrypted Mac hard drive.

As a final tip – Do not rely on one drive. Create backup copies on separate drives to avoid unexpected data losses.

A Guide to Solving Mac Hard Drive Problems

A Comprehensive Guide to Mac Hard Drive Recovery

Was this article helpful?

YES1

About The Author

Vishal

Vishal is a data recovery expert @Stellar. He addresses data loss scenarios on a Mac. He intends to help people solve their macOS problems. Besides, Vishal prefers to read about astronomy and autobiography, and his favorite is Steve Jobs - The man who thought different written by Karen Bluementhal.

77 comments

David says:

May 1, 2017 at 3:51 pm

I accidentally reformatted my 5TB HFS+ case-insensitive encrypted drive to FAT using quick format using the macOS Disk Utility GUI. It results in a failure leaving the drive unable to mount. A quick check in diskutil shows the partitions are still intact, yet macOS does not automatically detect the volumes. I presume some essential header information was deleted or corrupted by Disk Utility.

What happened was, I formatted the entire drive using the Erase dialog with Format “MS-DOS (FAT)” and Scheme “GUID Partition Map”
This resulted in an immediate failure with message: “Erase process has failed and Details: Couldn’t open device. Operation failed…” There doesn’t seem to be any options or flags to receive more verbose output.
At this point, the drive can no longer be mounted as macOS no longer recognizes the volumes on it and cannot automatically detect or repair them.

Is it possible to recover this encrypted partition/disk?

Reply
1. Vishal says:
  
  May 2, 2017 at 2:56 am
  
  Hello David,
  
  I am sharing the solution below with you:
  
  i) Connect your hard drive and go to Disk Utility
  ii) See if your hard drive is showing up in the left corner of the disk utility. (it will show as an unmounted drive)
  iii) Download Stellar Mac Data Recovery
  iv) Launch the software and click ‘Start Scan’.
  V) On the left corner of software drive menu << select your hard drive. Further select Recover Data << Advanced Recovery to launch data recovery scan. Let the software complete the scan. Vi) After the scan is over, all files from the external hard drive will be listed for the preview. You can double-click file(s) to get an instant preview of the files. Up to above, the software runs in the demo mode. To recover all your files you require to register the Stellar Mac data recovery software.
  
  Reply
Sawn says:

March 23, 2017 at 10:06 am

Vishal, my Western Digital 1 TB external hard drive is encrypted, but some files deleted accidentally. Ironically, I need to remove the encryption, and I know that the WD will get formatted and files will be gone. I have already backed up all files except those which got deleted recently. I am wondering if I should try Stellar and then remove decryption? Will it do the job?

Reply
1. Vishal says:
  
  March 24, 2017 at 8:38 am
  
  Hi Sawn,
  
  Better you do the data recovery first with Stellar Mac data recovery program and then go ahead to destroy hard drives encryption. Hope this helps.
  
  Reply
Ken says:

January 5, 2017 at 1:36 am

I was able to scan my encrypted drive that was formatted via raw recovery. It listed all the folders, and files from that drive.

But when I restored the file, the file has data. But when i try to open it, the application can’t read it. So I think the encryption is on the file as well, which I’m not sure if this software can de-encrypt the actual file.

Reply
1. Vishal says:
  
  January 9, 2017 at 4:14 am
  
  Hello Ken,
  
  Your query has been forwarded to technical support. Our executive will contact you soon to resolve your issue. Thanks.
  
  Reply
Alvis says:

January 4, 2017 at 9:20 am

Hello, Vishal!
Is there any chance to get back info from my main Mac SSD (it was encrypted) i formatted it and reinstalled a new OS on it? Forgot to backup one important thing.

Reply
1. Vishal says:
  
  January 4, 2017 at 9:26 am
  
  Hi Alvis,
  
  I recommend you free download Stellar Mac Data Recovery software and scan your SSD to preview your lost files. Thanks.
  
  Reply
  1. Alvis says:
    
    January 4, 2017 at 9:28 am
    
    Hey, i did it yesterday. Stellar gave me just the existing data, nothing from the data before formatting.
  2. Vishal says:
    
    January 4, 2017 at 9:44 am
    
    Hi again,
    
    Could you let me know which data recovery option you ran from the Stellar interface? Also, are you looking for some specific file type for recovery?
    
    Regards
    Vishal
  3. Alvis says:
    
    January 4, 2017 at 10:16 am
    
    Tried advanced recover data and also raw recovery.
    
    I think the software doesn’t know, that the disk was encrypted before. It is trying to restore it as it is right now.
  4. Vishal says:
    
    January 5, 2017 at 11:20 am
    
    Hi Alvis,
    
    Our support team will contact you soon.
    
    Regards
Pat Sterling says:

October 27, 2016 at 2:54 am

While working with my 1 TB encrypted hard disk drive (not FileVault encryption), I accidentally formatted it to FAT file system. The HFS+ 1 TB HDD had my years of photos, videos and college documents. In the absence of another backup copy of the hard drive how it is possible to restore data from the hard drive, which got accidentally erased?

Reply
1. Vishal says:
  
  October 27, 2016 at 3:03 am
  Hi Pat,
  
  Below are some important Discussions that matters
  
  Encrypted volume recovery wholesomely depends upon the several factors, which are as follows
  1. If the hard drive was encrypted to a single volume.
  2. If the hard drive was wholesomely formatted to FAT32 file system.
  3. Master Boot Record doesn’t overwrite a GUID table.
  4. Or the disk still runs a MBR and not PMBR.
  5. Hidden Core Storage structure shouldn’t get overwritten.
  6. FAT32 formatted HDD shouldn’t have overwritten blocks.
  Software Recommendations
  - TestDisk – Command based utility for data recovery
  - Stellar – GUI based data recovery on Mac disk drives
  Reply
Mic Taylor says:

July 14, 2016 at 9:01 am

My friend handed me an encrypted HFS+ hard drive for data recovery. I have Stellar Mac data recovery V6.0.0.3 installed on my iMac. The software is unable to scan the hard drive. How should I make it recover files from it. Do let me know quickly since your software has performed in the past and I need to get the data ASAP.

Reply
1. Vishal says:
  
  July 15, 2016 at 9:16 am
  
  Hi Mic, in order to scan and recover files from an encrypted hard drive, you must install Stellar Mac data recovery V7.0. Earlier versions of the software doesn’t support encrypted drive recovery. Please upgrade to latest version in order to save files.
  
  Reply
Ken says:

July 14, 2016 at 7:49 am

I scanned my macintosh encrypted hard drive and it found all the folders and files. But when I try to preview the file it doesn’t show anything. When I recover the file, I can’t open it in the application I used to create it. it says it’s not the right format.

Am I SOL?

Reply
1. Vishal says:
  
  July 26, 2016 at 9:56 am
  
  Hi Ken,
  
  Our Tech Support Team will contact you soon.
  
  Best Regards
  Vishal
  
  Reply
Kulin Makwana says:

July 9, 2016 at 1:02 pm

Hello, Want a help. I added new HDD and and El Capitan is running properly, Now when i inserted old HDD(USING USB) it shows me the folders except my home folder. I can access system folders, Shared Folders, But when i select my home folder (in my case kulin) it doesn’t show me any files inside.
I downloaded Stellar Mac Recovery and scanned it, it shows my folders (in quick scan) as lost folders. Now what to do?

I also tried using stellar volume optimiser and in optimiser when i select my old hdd it says its encrypted.

Will buying new stellar recovery solve my issue. please guide/help me so that i can proceed accordingly.
Waiting for your help.

Reply
1. Vishal says:
  
  July 11, 2016 at 3:01 am
  
  Hi Kulin,
  
  Thanks for writing your query to us, please find my answer below:
  
  When the software lists the HOME folder then you can double click it to view the files inside it. Doing this will let you know that the software will recover the following listed files from it. Once confirmed, you can register the product to recover and save the files to your local hard drive. Stellar Volume Optimizer is a Mac hard drive utility that repairs corrupt directory structure. Currently the software doesn’t support repairing an encrypted hard drive. Hope this resolves your problem.
  
  Reply
Duane S. Ring says:

June 24, 2016 at 10:56 am

Will Stellar Mac Data Recovery application recover encrypted iTunes backup files which got deleted from my iPhone 6S? Please let me know.

Reply
1. Vishal says:
  
  June 24, 2016 at 11:03 am
  
  Hi Duane,
  
  To recover deleted files or an encrypted iTunes backup files from an iPhone, you need to download and install Stellar Recovery for iPhone Application. It recoups deleted camera roll pictures, images, notes, iMessages, WhatsApp attachments, safari bookmarks. The best part of the software is its compatibility with OS X and Windows. List of Supports iPhones are iPhone 6S, 6 Plus, 6, 5s, 5c, 5, 4s and 4.
  
  Reply
Keith B. Grider says:

June 8, 2016 at 3:16 am

I encrypted my disk with File Vault on OS X El Capitan 10.11.5. I cleaned some files from the Mac and deleted them from trash later realising that some of my files were important. How can I get them back on this encrypted hard drive

Reply
1. Vishal says:
  
  June 8, 2016 at 6:24 am
  
  No worries Keith, you can recover back your files for free with Stellar Mac Data Recovery 1 GB Free Edition. Check this link out
  
  Reply