How to recover data from a Mac with T2 or FileVault encryption and without a password

It’s hard thing to discover that a loved one is incapacitated or passed away, and the Mac or Macs they left behind can’t be unlocked to retrieve photos, important financial or legal information, or any of their digital traces. If the main account or any administrative user password is unavailable, a newer Mac may be completely unrecoverable.

Many times, a person who experiences dementia may have already appointed or had appointed someone with the legal right to access their devices; someone who may know they were facing death or who had planned ahead with a will may have left their gear explicitly to someone, or appointed an executor who has rights. (This is not legal advice, by the way; consult an attorney with any questions about the legality of accessing such hardware.)

But the right or need to access a Mac doesn’t mean one has the ability, and Apple has designed its systems to prevent its own ability to break through strong protections.

The T2 Security Chip found in newer Macs ( see the list of Mac models here) brought iPhone- and iPad-style security and encryption to macOS, including Touch ID on laptops. The Mac’s startup volume is automatically encrypted at rest, separate from the long-running FileVault technology in macOS. (See “ How FileVault and the T2 Security Chip work together in newer Macs” for more details.)

The T2 chip on a Mac automatically encrypts the startup drive as a way to improve security dramatically—including rendering a drive’s contents unreadable if a device were lost or stolen. Without a fingerprint on a Touch ID-equipped Mac (for a computer that’s running, logged in, and in the right circumstances) or a password for any Mac, even without FileVault enabled, the contents of the Mac’s drive could be permanently unavailable.

If the Mac in question is one of the above models, skip to “Strategies to work around not having the password,” later in this article.

If it doesn’t have a T2 chip, you can try the following; if not, read on for what won’t work, and then strategies to try without the password.

Use Target Disk Mode or external drive startup

You may be able to mount a Mac as a volume on another Mac without a password using Target Disk Mode—as long as FileVault wasn’t enabled. You may not know if was, so you can try the following if both Macs have a FireWire (older models) or Thunderbolt 2 or 3 port:

1. Connect the computers.

2. Restart or startup the Mac you want to mount on the other while holding down the T key.

3. If it works, a volume icon appears on the other Mac.

If you receive a prompt to enter a password, then either FileVault is enabled or there’s a T2 chip on the computer—or even both.

However, if you don’t have another Mac to try this with or they don’t have compatible ports, you can also set up an external, bootable macOS drive with a version of macOS new enough to start up the computer in question and not too new for an older Mac. (Consult the Mac’s model to check on which system releases work with it.)

Here’s how to boot from an external drive:

1. With a macOS startup volume installed on an external drive, plug it into the Mac you want to start up.

2. Either restart the Mac or start it up, holding down the Option key as it powers up.

3. A roughly formatted display showing available startup drives should appear. Click or use a keyboard to select and boot from that drive.

4. The internal drive shows up as a volume after macOS starts up.

If you can’t start up from an external drive because you’re prompted for a password or blocked in another fashion, or macOS prompts you for a password to mount the internal drive (as above), you’re stuck.

What won’t work

In nearly every scenario involving either a Mac with a T2 chip, FileVault enabled, or both, you have to have an administrative account’s password, often the main or only account on a Mac:

• With FileVault turned on with any Mac, a password has to be entered at startup to even start macOS running. Otherwise its startup volume remains unavailable.

• With the T2 chip and no FileVault, a Mac will boot to the startup screen, but unless you had the password, even though the drive’s contents are available to a user, you’d have to break into macOS to gain access to files. Because the T2 chip restricts starting up with an external drive without making a specific administrative change that requires a password, you won’t even be able to boot off an external drive—and you’d need an account password after that to mount the drive when started up externally, in any case.

• You might consider removing the hard drive as one strategy. But Macs of the last few years have drives that can’t easily be removed or are impossible to remove at all. Even if you could mount a drive on another device, if FileVault is enabled or it’s a mac with a T2 chip, it’s impossible to decrypt the drive’s contents.

Apple

Don’t give up yet, however.

Strategies to work around not having the password

Several strategies can help, some of them absurdly low tech:

• Check for sticky notes, password books, or other places someone may have written down their password. This is surprisingly common, yet often overlooked. (The best “hackers” in movies always make a joke about it when asked what sophisticated cracking tool they will use: they just find the sticky note.)

• Did the person ever give you a password as a backup in case they lost or forgot theirs? Check your messages, password manager, or notes.

• Look for local backups. While startup drives may be encrypted via FileVault or the T2 chip, Time Machine and other backups typically aren’t, unless someone takes an extra step to encrypt the volume. (If they did that, they might also have taken steps to allow someone else to gain access later if they couldn’t.) Look for a drive directly connected to the computer, to another computer on the network, or a Time Capsule, Apple’s discontinued networked Time Machine backup option.

• Look for online backups. A person may be using a cloud-based backup storage system, like Backblaze or Carbonite, and you may be able to find the password for that if you can’t find their Mac account’s password. Check credit-card bills to see if they’re using such a service.

• Check iCloud. Again, you might be able to find or figure out their iCloud login, and retrieve photos and synced files from iCloud.

• Look for other sync services. Dropbox, Google Drive, OneDrive, and other options can sync the contents of folders or nearly an entire drive from a computer to cloud-based storage.

Preparation always helps, too. If you’re reading this column prospectively—before a problem has cropped up—see “ How to prepare your digital assets in case of death” for advice on setting up yourself or helping someone else be set up for access when they can’t provide a password.

This Mac 911 article is in response to a question submitted by Macworld reader Janvier.

Ask Mac 911

We’ve compiled a list of the questions we get asked most frequently along with answers and links to columns: read our super FAQ to see if your question is covered. If not, we’re always looking for new problems to solve! Email yours to mac911@macworld.com including screen captures as appropriate, and whether you want your full name used. Not every question will be answered, we don’t reply to email, and we cannot provide direct troubleshooting advice.