1

Recently, I had an accident with my Macbook Pro. I dropped water on it and the motherboard is now dead, which means my Macbook Pro is also dead. Hopefully, the hard drive isn't damaged. When I plugged the hard drive of my Macbook Pro into another computer (a Windows PC) with a USB, I realized that it couldn't be opened because my hard drive was encrypted with FileVault 2 (Core Storage). I now have several questions.

  1. Can I decrypt the external hard drive FileVault directly on a Windows PC ? I found some programs like Passware Kit Forensic which claims they can do it ! Is there any other program?

  2. If I plug the external hard drive into another Mac with a USB, can I decrypt the FileVault directly on it so I can open it later on a Windows PC? I have some friends with a Mac, but I want to be sure I can disable FileVault on their Mac before asking them!

  • If you specify your and your friends' Macs and the installed OS Xs I specify my answer. – klanomath Dec 26 '15 at 16:42
1

There is no need to decrypt the FileVault password with a 3rd-party tool like Passware Kit Forensic. You just have to unlock it with the hopefully known password/passphrase.

You may either:

  • Plug the external case containing the hard drive into another Mac and try to boot from it. Then revert the encryption in System Preferences > Security.
  • Plug the external case containing the hard drive into another Mac and try to revert the encryption by entering the following Terminal commands:

    diskutil corestorage list
    diskutil cs unlockVolume lvUUID #UUID of the encrypted logical volume
    diskutil cs revert lvUUID #UUID of the encrypted logical volume
    

    Consider that the Mac may also have a CoreStorage Volume Group.

Requirements:

The Mac has to be bootable with the "FileVaulted" system (i.e you can't use a PowerBook or an old iMac).

If you want to further process the data of the now decrypted drive with a PC, you have to install a software/driver in Windows capable of at least reading HFS+ volumes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .