What is FileVault and why does recovery require the key?
Short answer: FileVault is macOS’s built-in full-disk encryption. When enabled, it encrypts every file on your Mac’s drive using XTS-AES-128 encryption — a block cipher used in secure communications and banking systems worldwide. The encryption key is derived from your login password and either stored with Apple (iCloud-based) or given to you as a 24-character recovery key. Without one of these two — your password or the recovery key — nobody can read the files on the drive. This is true even if a lab physically removes the NAND chips from an M-series Mac. The raw data on those chips is mathematical noise without the decryption key.
How to recover a FileVault-encrypted Mac
Step 1: Try your login password in Recovery Mode
The simplest path — often missed in a panic — is to simply try your login password in macOS Recovery. Restart the Mac and hold Command+R (Intel Mac) or hold the Power button until the Options screen appears (M-series Mac). From the recovery utilities, choose Disk Utility and try to mount the encrypted volume using your usual login password. FileVault uses your login password as the primary encryption credential, so if you know the password, you can unlock the drive here even if it will not boot normally. This resolves a significant number of the FileVault calls we receive — the Mac was not booting due to a software issue, not a FileVault problem. Once the volume is mounted, files can be copied to an external drive. For related partition issues on Mac, see our APFS partition recovery guide.
Step 2: iCloud-based recovery key reset
If you chose “Store the recovery key with Apple” during FileVault setup (the recommended option for most users), you can reset your password via your Apple ID. In macOS Recovery, choose “Activate Mac” and sign in with your Apple ID. Apple’s servers verify your identity and allow a password reset, unlocking the drive. This requires: (1) the Apple ID associated with the Mac, (2) access to the Apple ID password, and (3) two-factor authentication verification on a trusted device or phone number. For Indian users with Indian mobile numbers, the 2FA SMS arrives on the registered number — make sure it is still active. If you have switched SIM cards or numbers since setting up the Mac, you need to use a trusted device (another iPhone, iPad, or Mac signed into the same Apple ID) instead.
Step 3: Using the local recovery key
If you chose “Create a recovery key” at FileVault setup, you were given a 24-character key (format: XXXX-XXXX-XXXX-XXXX-XXXX-XXXX). In macOS Recovery, Disk Utility will prompt for this key when you attempt to mount the encrypted volume. The key is case-sensitive and must be entered exactly. If you saved this key to a password manager, a document, or a physical location, retrieve it now. If it has been lost — never printed, never saved anywhere — the drive is permanently inaccessible. No Apple support ticket, no Apple Authorised Service Provider, and no data recovery lab can retrieve the data. Apple does not hold a copy of locally generated FileVault keys.
Step 4: The India angle — why cleanroom cannot bypass FileVault
A cleanroom data recovery lab can physically open a hard drive and reconstruct data from damaged platters, or read NAND chips directly from a dead SSD. What a cleanroom cannot do is decrypt data. The AES-XTS encryption used by FileVault operates at every sector of the drive — even the smallest fragment of a file is encrypted. When labs read NAND chips directly from an M-series Mac, they read approximately 512 bytes of meaningless ciphertext per sector. There is no portion of the drive that is unencrypted and useful. This is a crucial point for Indian users considering expensive chip-off recovery: if FileVault is active, cleanroom work cannot help. The only scenario where hardware work helps is when the Mac has hardware damage (a failed logic board, a damaged connector) alongside the encryption — once the hardware is repaired or the drive is extracted and decrypted with the correct key, the underlying file system can then be repaired. See our data recovery options guide for India for the full landscape.