Disk Drill for Mac supports data recovery from encrypted APFS and HFS+ volumes, including FileVault-protected drives. Recovery depends on whether the volume can be unlocked and the missing files are still available on the storage device.
Do I Need a Password to Recover Encrypted Files?
Yes. You need valid credentials to unlock the volume. For a FileVault-protected startup disk, this may be an authorized user’s Mac login password or a FileVault recovery key. An encrypted external drive may have a separate password.
Disk Drill cannot bypass encryption. You do not need to turn off FileVault or permanently decrypt the entire drive before scanning.
Which Drive or Volume Should I Scan?
- Unlocked HFS+ volume: Select the unlocked volume under Logical Volumes in Disk Drill.
- Locked HFS+ volume: Open Disk Utility, select the encrypted volume, and click Mount. Enter its password if prompted, then return to Disk Drill and select the unlocked volume.
- Encrypted APFS volume: Select the affected volume in Disk Drill. You can also scan its parent APFS container or physical drive. Enter the password or supported recovery key when prompted.
How to Recover Files With Disk Drill
Before you begin, stop saving files to the affected drive. Recover important data before attempting repairs or formatting.
- Open Disk Drill for Mac and grant the requested disk access permissions.
- Select the affected drive or volume using the guidance above.
- Click Search for lost data and choose Universal Scan if prompted. Unlock the volume when asked.
- Let the scan finish, then click Review found items. Filter the results and preview the files you need.
- Select your files, click Recover, and save them to a different physical drive.
When Encrypted Drive Recovery May Not Work
Recovery may be impossible if the password and recovery key are unavailable, essential encryption information is damaged, or the file data has been overwritten or cleared by SSD TRIM.
On Macs with Apple silicon or a T2 chip, erasing an internal volume can destroy its encryption keys. The previous password cannot restore data whose keys are gone. In these cases, check Time Machine or another backup.