CASE: I have lost data from my Mac which is encrypted with FileVault. Now, I want to recover my lost data. As I am not using Time Machine backup, I don’t have the option to restore the lost data by using Time Machine. I used a third party tool - Stellar Data Recovery Software for Mac but not able to recover the data. Is there something that I missed or went wrong while trying to recover my lost data? Please help me in recovering data from FileVault Encrypted Mac device.

Are you facing a similar situation while trying to recover lost data from a FileVault encrypted Mac drive? If yes, this post is worth reading.

In this post, we’ll explain about the FileVault encryption feature in Mac, and the step-by-step process to recover your lost data from FileVault encrypted Mac by using a third party data recovery tool.

What Is FileVault?

FileVault is a data security feature that was first introduced in Mac OS X 10.7 “Lion”. Since then, this feature is available in all the later versions of macOS till the latest Catalina. When you turn ON the FileVault feature, it encrypts data on your Mac startup disk. It encodes the data by using an algorithm known as a cipher, which prevents unauthorized access of the data, thus ensuring safety and privacy of your data.

In case you’ve lost data from FileVault encrypted Mac drive and trying to recover the data from it by using a third party data recovery software, your Mac may not allow the software to access the drive. In such a case, you need to first turn OFF the FileVault encryption feature to recover the lost data from such drive.

How to Turn OFF FileVault Encryption on Mac?

Here are the steps to turn OFF FileVault encryption feature on your Mac:

[NOTE]:

The decryption process could take a while, depending upon the amount of data stored on the drive. However, you can still use your Mac to do other tasks while decryption runs in the background.
To turn OFF FileVault, Administrator login name and password is required.

On your Mac, choose Apple menu > System Preferences
Click Security & Privacy, and select FileVault
Click the lock icon
Authenticate by providing administrator name and password when prompted
Click Turn Off FileVault
Click Turn Off Encryption

Now that you’ve turned OFF FileVault on your Mac, you’re one step away from using a third-party data recovery software on your Mac.

Before You Begin Using the Third-Party Data Recovery Software

For a data recovery tool on your Mac to work, you need to turn OFF System Integrity Protection (SIP) which is by default enabled on your Mac system. It prevents third-party programs from accessing system files.

Steps to turn OFF SIP:

Restart your Mac system and hold down Command+R (⌘+R) keys until the Apple logo appears or you hear the startup chime. This will boot macOS into Recovery Mode.
Click the Utilities drop-down menu at the top of the screen, and choose Terminal to open a Terminal window
Type csrutil disable command on the Terminal, and hit Return key
Restart the Mac system for the changes to take effect

Now, you can use an effective data recovery tool such as Stellar Data Recovery software to recover the lost data from your FileVault encrypted Mac.

Steps to Recover Data from Mac by Using Stellar Data Recovery Software

Launch Stellar Data Recovery Software for Mac (if not already launched/downloaded) download from the link below
Free Download
From the main interface, turn ON the toggle switch in accordance with the type of files you want to recover and click Next
On Select Location screen, select the Mac drive from where you want to recover data and then click Scan.
You can also toggle ON Deep Scan switch at the bottom-left corner. Deep Scan is a comprehensive file signature-based search for maximum recovery in tough data loss cases such as drive formatting, corruption, etc.
When the scanning process completes, click OK.
You’ll be able to see the list of all the recoverable files on the selected Mac drive.
You can preview a file by clicking the desired folder, and double-click any file on the right pane to preview it. This helps in making a decision whether or not you want to save a recovered file.
Select the files you want to recover, and click on the Recover button
Browse a location to save the recovered files.
Select a different location other than the drive from where you’ve lost data.
Click Save to start saving the recovered files

This will save the recovered data at your selected location.

Post Data Recovery Actions

Once you’ve recovered your lost data, you can now enable the SIP, which you’d turned OFF before running the software.

The process to enable the SIP is similar to disabling it (as mentioned above). The only difference is that you’d need to run csrutil enable command instead of csrutil disable.

You can also turn ON FileVault after recovering the data.

Steps to enable FileVault:

On your Mac, choose Apple menu > System Preferences, click Security & Privacy, then click FileVault
Click the lock icon and enter administrator name and password when prompted
Click Turn On FileVault
As you click Turn On FileVault, your Mac system gives you two options to choose from for unlocking your drive and resetting the login password in case you forget it:
- Use your iCloud account: Click “Allow my iCloud account to unlock my disk”
- Create a recovery key: Click “Create a recovery key and do not use my iCloud account”.
  [Important]: If you choose “Create a recovery key and do not use my iCloud account” make sure that you write down the recovery key and keep it in a safe place. You would never be able to unlock the disk and reset password if you lose this key.
Choose any of the above options as per your need
Follow on-screen instructions to complete the process
[NOTE]: Once you enable FileVault, all the allowed users will have to enter the password to unlock the disk.

Conclusion

Mac systems have built-in security features which are helpful in preventing data breach and misuse of your data by nefarious elements. One such useful feature is FileVault, which can be used to encrypt data on Mac startup disk. When you lose data from Mac drive encrypted with FileVault, you may be unable to recover the lost data by using a third-party tool.

To recover data from FileVault enabled Mac drive, you need to first disable the FileVault. In this post, we’ve discussed the steps for disabling/enabling FileVault and also for another Mac security feature called System Integrity Protection (SIP). After disabling FileVault and SIP, you can successfully recover data by using Stellar Data Recovery software. The tool has a powerful scan engine to recover data even from severely corrupted Mac drive. It supports a wide-range of file types and is compatible with macOS Catalina 10.15, Mojave 10.14, High Sierra 10.13, & other lower versions up to 10.7.