Mac Data Recovery

Guide to Recover Data from an Encrypted Mac Hard Drive

Written By Vishal
Approved By Rohit Arora
Updated on 5 Aug, 2024
Min Reading 8 Min
Share

Table of Content

Summary: Hard drive encryption is a useful utility on Mac that helps users password-protect their confidential data on the system or an external hard drive. Sometimes, an encrypted hard drive becomes inaccessible & malfunctions due to logical errors. In this blog, learn how to encrypt & decrypt an external hard drive or the native disk drive on Mac. Also, get a guide to recover data from a malfunctioning or inaccessible encrypted hard drive.

Free Download100% secure

Drive encryption in Mac allows users to secure confidential data from unwanted access or theft. Users can enable drive encryption on a Mac’s native disk drive and external storage drives like HDDs, SSDs, etc.

The only way to decrypt an external Mac hard drive and access its data is to enter the decryption key. Without it, you won’t be able to access or recover your data from an encrypted Mac hard drive/solid state drive.

Let’s dive in to learn more about Mac disk drive encryption & decryption in detail.

What is Mac Hard Drive Encryption?

macOS offers FileVault – a built-in feature to encrypt native Mac disk drives and external hard drives to protect your data from prying eyes, thefts, and hackers. FileVault full-disk encryption (FileVault 2) uses XTS-AES-128-bit encryption with a 256-bit key to help prevent unapproved access to the information on your startup disk.

How to Encrypt and Decrypt Mac Hard Drive?

macOS has several native methods to encrypt and decrypt a Mac hard drive. The following sections illustrate the methods in detail. We will also look at how to recover data from an encrypted or corrupt Mac hard drive.

Method 1: Encrypt or Decrypt Mac hard drive using Finder

macOS Finder allows you to encrypt or decrypt your internal or external Mac hard drive and volume quickly.

Encrypt a Storage Drive using Finder

To encrypt your Mac hard drive by using Finder, perform the following steps –

Use the internal Mac volume or connect the external storage drive you wish to encrypt.
Launch Finder, and from the left pane, secondary-click a drive or volume and select the Encrypt ‘Drive_Name’ option.

Set a password and hint as requested by macOS. Wait until the hard drive encrypts. From now on, you need to key in the password to unlock the drive.

Similar to encrypting a hard drive, macOS Finder also makes the process of decryption easy.

Decrypt a Hard Drive Using Finder

Open Finder, and from the left pane, secondary-click on the encrypted hard drive and select the Decrypt ‘Drive_Name’ option.
After decrypting the drive, access the hard drive directly without any password.

enter password to decrypt mac hard drive

Method 2: Encrypt or Decrypt Storage Drive using FileVault

FileVault is the native disk encryption application that allows you to encrypt your startup disk. It uses your login password as an encryption key.

Encrypt your Mac hard drive using FileVault –

Go to Apple menu > System Preferences > Security & Privacy > FileVault tab.
Click the Lock icon and enter admin credentials. Click the “Turn On FileVault” button.
Provide a password to encrypt the disk. Your Mac encrypts the disk in the background. You can check the encryption progress from the FileVault section.
After encryption, restart your Mac and provide the login password to finish starting up.

turn on hard drive encryption on mac via file vault

Decrypt your Mac hard drive using FileVault –

Open the FileVault tab from Security & Privacy, as explained before. Click the “Turn Off FileVault” button. Your Mac decrypts the disk in the background. You can check the decryption progress from the FileVault section.
After decryption, restart your Mac. Now, you won’t need any password to unlock your Mac hard drive.

Method 3: Encrypt or Decrypt Storage Drive using Disk Utility

Disk Utility has the option to erase your Mac hard drive in an encrypted format—APFS (Case-sensitive, encrypted), Mac OS Extended (Journaled, Encrypted), or Mac OS Extended (Case-sensitive, Journaled, Encrypted).

Encrypt your Mac hard drive using Disk Utility –

For non-startup disks, launch Disk Utility from Finder > Applications > Utilities. Or else, press Command + Spacebar to bring Spotlight. Type disk utility and click the Disk Utility search result to launch the application.
From Disk Utility, select the internal non-boot Mac volume or the external hard drive you want to protect via password, and click the Erase tab.

Warning: Erasing a drive will remove all its content, so back up before performing the erase operation.

In the Format section, click the drop-down menu to select an encryption format.

In the Name section, provide your hard drive with a name and click Erase. Before macOS erases the drive, it displays a dialog box asking for a password.
Enter a password that is easy to remember yet difficult to crack for others. Don’t forget to provide a Password Hint. Disk Utility completes the erase process of your hard drive.

When the erase process is over, the encrypted drive mounts on the Mac. Enter the drive’s password each time you access it. If you forget the password, the drive will become inaccessible.

Encrypt Macintosh HD, the startup disk, using Disk Utility in macOS Recovery mode –

Start or restart your Mac immediately by pressing and holding the Command + R keys. Release the keys when the Apple logo appears. Your Mac boots into macOS Recovery mode.
From the macOS Utilities window, select Disk Utility and click Continue. Erase the startup disk in an encryption format after backing it up using Time Machine.
Reinstall macOS from the macOS Utilities window. Finally, restore the backed-up data from the Time Machine backup drive to the encrypted drive.

Disk Utility also lets you decrypt a Mac hard drive that you have erased using an encryption format.

Decrypt your Mac hard drive using Disk Utility –

Open Disk Utility, then select your encrypted storage drive.
To unlock the hard drive, go to File > Unlock ‘Drive_Name.’
Enter the password when prompted.
To decrypt the hard drive, go to File > Turn Off Encryption.

Method 4: Encrypt or Decrypt Storage Drive using Terminal

Terminal is a powerful application that can help you encrypt or decrypt your Mac hard drive. However, working with Terminal requires a complete knowledge of the Terminal commands, and any incorrect operation can result in data loss. So, back up your data from the drive before executing any Terminal command.

Encrypt a hard drive using Terminal –

Launch Terminal from Finder > Application > Utilities.
Type diskutil apfs list and hit Return. The Terminal produces a list of all APFS volumes and containers. Note down the APFS volume ID information.
To encrypt volume, type diskutil apfs encryptVolume /dev/apfs_volume_id and hit Return. Type the password for encryption when asked. Type again to confirm the password.
To monitor encryption progress, type diskutil apfs list and hit Return.

Similarly, you can decrypt your encrypted Mac hard drive by using Terminal.

Decrypt an APFS encrypted drive using Terminal –

Launch Terminal. Type diskutil apfs list and hit Return to know the APFS volume ID.
Type diskutil apfs unlockVolume /dev/apfs_volume_id -passphrase type_the_key, then hit Return to unlock the volume.
Type diskutil apfs decryptVolume /dev/apfs_volume_id and hit Return to decrypt the volume. Authenticate when prompted.
To monitor decryption progress, type diskutil apfs list and hit Return.

For other drives, do the following –

Launch Terminal and type the code diskutil cs list and hit Return. The Terminal produces a core storage list in a hierarchy. Copy the alphanumeric code that is logical volume UUID, which is next to Logical Volume Group.
Type diskutil cs decryptVolume logical_volume_uuid -passphrase type_the_key and hit Return.

But what if you delete few crucial files from an encrypted hard drive, or the drive itself turns corrupt. In such cases, you’ll need to find ways to recover your lost data.

Recover Data from an Encrypted Mac Hard Drive

Part 1: Recover Encrypted Mac Hard Drive using Time Machine

Mac data loss can occur from an encrypted hard drive due to accidental deletion, formatting, or corruption. So, setting up a Time Machine backup hard drive is a must.

Time Machine performs incremental backups of your encrypted Macintosh HD per the schedule. And in case of data loss, you can use Time Machine to restore the lost data to your Mac drive.

Steps to recover encrypted Mac hard drive with Time Machine –

Ensure your Time Machine backup drive is connected to your Mac. Launch Time Machine from the Launchpad.
Find the deleted or lost files by using Up/Down arrows or Timeline. Select the required files and folders, then click Restore. The files will restore to their actual location.

Part 2: Recover Encrypted Mac Hard Drive Data using a Mac Data Recovery Software

What if you haven’t set up Time Machine on your Mac or the configured Time Machine backup drive has become corrupt? In such cases, only reliable data recovery software for Mac like Stellar Data Recovery Professional for Mac can help you recover data from an encrypted hard drive.

Install Stellar Data Recovery Professional for Mac. Launch it.
On the first screen, select what you want to recover. By default, Recover Everything option is selected. Click Next.

launch stellar data recovery professional for mac

On the next screen, choose the Encrypted Volume. Enter the Password and click Continue.
Click Scan.

Notes –

If you fail to provide a passcode to unlock your encrypted hard drive, the software won’t proceed further to scan your encrypted drive.Once the drive is unlocked, re-select the drive, and you can either switch to Deep Scan or stick with the primary scan option at your convenience.

Once the scanning is completed, the software will list all the recoverable items. Preview the items.

recover data from encrypted mac hdd using stellar data recovery professional for mac

If you are satisfied after the preview, select the files for recovery. Click Recover and choose a place to save recoverable files.

Watch this video to learn how you can encrypt, decrypt, and recover data from an encrypted Mac hard drive.

Note – In case of a corrupt encrypted Mac hard drive, the software will perform RAW recovery on the physical drive. In such a scenario, the files names might look different. You can recover the desired files by previewing them one by one.

What if the Decryption Password is Lost?

If the decryption password is lost, the data on your encrypted Mac hard drive is lost forever. You won’t be able to retrieve it even with the help of a data recovery software. Therefore, keep the decryption key saved in a secure location to use when required.

Conclusion

Although macOS has made encrypting hard drives easy and convenient, one should be careful while doing it. A decryption key or password is required to access an encrypted device. Losing the decryption key can make the drive permanently inaccessible, and you may lose your data forever.

Therefore, you keep the decryption key of the drive safely and within your reach.

If you have the decryption key but still can’t access the data on the drive, you should use Stellar Data Recovery Professional for Mac to recover data from an encrypted Mac hard drive.

As a final tip – Do not rely on one drive. Create backup copies on separate drives to avoid unexpected data losses.

A Guide to Solving Mac Hard Drive Problems

A Comprehensive Guide to Mac Hard Drive Recovery

Was this article helpful?

YES1

About The Author

Vishal

Vishal is a data recovery expert @Stellar. He addresses data loss scenarios on a Mac. He intends to help people solve their macOS problems. Besides, Vishal prefers to read about astronomy and autobiography, and his favorite is Steve Jobs - The man who thought different written by Karen Bluementhal.

77 comments

hh says:

April 21, 2019 at 4:51 pm

Hi, My External USB hard drive was accidentally erased by a Bad software without my permission, My hard drive was APFS Encrypted and I have always my password and information in my APPLE Keychain.

Now my hard drive is in APFS without encryption, if I use Lost volume scanning, and after that use Deep Scan in old APFS Volume I’ll see my file ? do you think I’ll have the option to see my encrypted volume ? and the opportunity to put my password ? I have it.

Thank you for your help

Reply
1. Vishal says:
  
  April 22, 2019 at 3:12 am
  
  Hello hh,
  
  Instead, try to recover the drive via Deep scan feature only (not using can’t find volume). watch this video for more.
  Let me know further.
  
  Reply
David B. says:

March 17, 2019 at 11:29 pm

I accidentally erased a hard drive that was connected to my Mac. I was wondering if this product would help.

The drive has a GUID partition scheme. On that drive I used Disk Utility to created one large partition which was formatted as a “Mac OS Extended (Journaled, Encrypted)” volume. I know the password that was used and this drive has worked reliably for several years in that configuration.

(Even though I set it up as one large partition, my understanding is that sometimes the Mac will also create a hidden “Recovery” partition on the same drive as well. I am about 75% certain it had done so in this case.)

A few days ago, I was using the Disk Utility program and erased that volume by mistake. Disk Utility then created a new “Untitled” partition, formatted as a “Mac OS Extended (Journaled)” volume. That step took only about 5 seconds (so it did not do a low-level erase or format operation).

I have hardly used the disk at all since this happened a few days ago. I’ve mounted the drive (read the file system) a few times because I wanted to collect info about the drive. However I have not “saved” any files to it (beyond the various invisible files that the Mac OS places on a new disk).

So in summary:

– Using Disk Utility I erased the main “Mac OS Extended (Journaled, Encrypted)” volume on a drive (I have the above password used to encrypt that volume)
– Disk Utility created a new “Mac OS Extended (Journaled)” volume on that partition
– I haven’t stored any user files on the drives since

Is there any hope for getting my files (and hopefully the folder structure) a back?

Reply
1. Vishal says:
  
  March 18, 2019 at 3:20 am
  
  Hello David,
  
  Thanks for writing your query. Please find my reply below:
  
  Stellar Data Recovery Professional for Mac recovers data from a formatted APFS, HFS hard drive.
  
  –Download and install the free trial version of the software and scan your formatted Mac hard drive via Deep Scan. Allow the software to complete the scan. Once done, it will show you all the recoverable files. Since the drive was formatted and so the encryption algorithm you may not require the password to unlock the drive before scanning.
  
  -Good to know that you have taken the precaution after formatting the drive by not writing new data to it. I advise you to scan the disk sooner than later to analyze the recovery.
  
  Regards
  Vishal
  
  Reply
Alfred Cohen says:

January 24, 2019 at 10:11 am

Stellar Mac Data Recovery Software works marvellously on internal and external hard drives, USB flash drives, SSD drives and many other appliances.

Reply
1. Vishal says:
  
  January 25, 2019 at 4:47 am
  
  Dear Alfred,
  
  Thanks for mentioned good words about mac data recovery software.
  
  Reply
Liliana says:

July 8, 2018 at 9:30 pm

I am glad to be one of the visitors on this great website, appreciate it for posting.

Reply
1. Vishal says:
  
  July 9, 2018 at 4:58 am
  
  Thanks Liliana
  
  Reply
leneth says:

February 14, 2018 at 11:18 am

hello vishal.. do i really need to buy the mac data recovery for me to get a registration key and activate the product? i really need to recover my files. thank u very much.

Reply
1. Vishal says:
  
  February 15, 2018 at 3:26 am
  
  Hello Leneth,
  
  Thanks for contacting Stellar Data Recovery
  
  Yes, to save the recovered data with Stellar Mac Data Recovery; you need to register the product. Once it is activated, it will save the files to your chosen destination.
  
  Reply
Vishal says:

October 4, 2017 at 2:58 am

Hi Borisio,

Did you try scanning your hard drive with Stellar Mac Data Recovery software?

Reply
1. Borisio says:
  
  October 11, 2017 at 11:38 pm
  
  this is the quick scan of this drive, long one produces similar thing.
  
  Reply
2. Vishal says:
  
  October 12, 2017 at 9:19 am
  
  Hi borisio, try RAW Recovery on your hard drive using Stellar Mac Data Recovery.
  
  Reply
Justin says:

August 24, 2017 at 4:51 pm

Hi Vishal,

I have a 2TB WD external hard drive. There was an encrypted folder with password and I still remember the password.
One day, I made a mistake to format the entire WD hard drive by Disk Utility with a different format (EXfat), but I realized my mistake just after the incident and did not save/write any file in it.
(I can’t remember what was the previous format…)

Can SDR still search for the formatted encrypted folder for me to insert the password, then start restoring my folder in this situation??

Your feedback will be much appreciated.

Thank you.

Reply
1. Vishal says:
  
  August 27, 2017 at 6:34 am
  
  Hi Justin,
  
  We recommend you to follow the below steps to recover the data using Stellar Mac Data Recovery:
  
  1. Select Start New Scan option from main interface screen.
  2. Select the drive from which you want to search the lost /deleted volumes.
  3. Select Search Lost / Deleted Volumes option from listed scanning method.
  4. Click Start Scan button to start scanning process. Software will scan and display all the lost/deleted volumes of your drive.
  5. Now, select the lost volume that you want to scan for data from the list of volumes.
  6. Select ‘Recover Data’ option and start the scan.
  
  Reply
  1. Borisio says:
    
    October 3, 2017 at 1:29 pm
    
    Vishal can yo uplease view the poat below this one, many thanks!
CC says:

June 27, 2017 at 10:52 pm

Hi, I have a WD My Passport for Mac 500GB Portable External Hard Drive Storage USB 3.0. I used the password protect feature and haven’t changed my password. But all of a sudden, the same password no longer works. I have tried on 3 different computers.
May I know does the free MAC data recovery tool help to retrieve the files I need given I will continue using the same password?

Thanks for all the help.

Reply
1. Vishal says:
  
  June 28, 2017 at 2:37 am
  
  Hi CC,
  
  Stellar Mac Data Recovery does support data recovery of deleted files from an encrypted hard drive. Though, the first condition to perform recovery is the user must unlock the drive by the password. Once you are through, you can start the scan and recover files. In your case, the drive isn’t accepting your password, though you should at least try once with Stellar and provide the same password. However, chances are low that your drive will get unlocked. Please try once. Download the software from here
  
  Reply
V Lewin says:

June 23, 2017 at 7:56 pm

I damaged my old Macbook Pro with water. I bought a Macbook Air. I migrated data to it from a WD MyBook drive. It seemed to go smoothly. Then I had second thoughts about the Air and also bought a Macbook Pro, planning to return one of them. I migrated data the same way but not everything came over. I called tech support. The tech, for some reason, had me encrypt my hard drive. I didn’t have that much on it but it took over 37 hours. As it turns out, I prefer the Macbook Pro and want to return the Air. But the Air seems to have my all data while the Pro doesn’t. I really do not need encryption for anything. I want to decrypt the hard drive. I want to transfer all my data to the Pro. The only think I know for sure is that the Air seems to have all my data. I have an appointment with a senior advisor this evening. How do I get my data onto the Macbook Pro and how do I decrypt the external drive without losing anything? Also, will it work to migrate encrypted data to the Pro? I have a bit of a time crunch and am worried whatever process I do will take days again. Thank you.

Reply
1. Vishal says:
  
  June 28, 2017 at 2:43 am
  
  Hi V Lewin,
  
  I migrated data to it from a WD MyBook drive. It seemed to go smoothly. Then I had second thoughts about the Air and also bought a Macbook Pro, planning to return one of them. I migrated data the same way, but not everything came over. I called tech support. The tech, for some reason, had me encrypt my hard drive
  
  Did you transferred the data from My Book to Air with encryption or without the encryption? What were those some reason that tech support encrypted your disk?
  
  I recommend you clone your MacBook Air hard drive to an external drive since your MBA have complete data on it. Once the backup is done, decrypt the drive (See decryption steps in the article).
  
  Reply
Russell Pearce says:

May 20, 2017 at 12:34 am

I accidentally use the password assisting when encrypting my external drive, so there is no way for me to know what password I chose. I didn’t realize the “password assistant changed my password when moving the Password Assistant slider. This sucks! Why would Apple let the Password Assistant create the password and verify it at the same time. What options do have to recover my files? Should I erase the drive with a low erase setting, then try to recover as much files as I can? Please provide some help! This hard drive had over 4 years of my recordings.

Reply
1. Vishal says:
  
  May 24, 2017 at 10:57 am
  
  Hi Russell
  
  Without unlocking the encrypted partition data recovery is not possible using Stellar Mac Data Recovery. Erasing the HDD with low erase setting also data will not show in decrypted from, so recovery is not possible. Please let me know if there are further queries.
  
  Thanks.
  
  Reply