Unlocking and Decrypting FileVault-Encrypted Hard Disk on macOS Ventura

Question

Level 1

4 points

Unlocking and Decrypting FileVault-Encrypted Hard Disk on macOS Ventura

Hello,

I have an old Seagate 2TB SRD0NF1 hard disk that I got back in 2017. Later in 2018, I converted it to a backup disk to use with time machine, and selected the option to encrypt it with FileVault. Years later in 2024, I've come back to it because there were a number of old files and music projects (logic files) that I wanted to come back to.

The disk is recognized by my new OS, and it requests for my password, which I know is correct. However, the disk either (1) does not mount properly or (2) takes a very long time to mount, and when it does (which I have only successfully done once, but I am having a hard time replicating this) the files are slow to open folders, etc. I believe this is because of a combination of (1) the encryption and (2) the relatively slow memory bandwidth of hard disks (relative to modern SSDs).

My question is this: how can I fully decrypt the disk and rewrite the decrypted contents back to revert it back to a traditional, unencrypted hard disk, without needing to reformat or erase the drive?

Notes:

> $ diskutil cs list
CoreStorage logical volume groups (1 found)
|
+-- Logical Volume Group C742B577-4CF1-42E4-BD79-055D07508A0C
    =========================================================
    Name:         Seagate2TB
    Status:       Online
    Size:         2000054960128 B (2.0 TB)
    Free Space:   18923520 B (18.9 MB)
    |
    +-< Physical Volume 84210736-AAF9-4D18-9550-5C278EA8511E
    |   ----------------------------------------------------
    |   Index:    0
    |   Disk:     disk4s2
    |   Status:   Online
    |   Size:     2000054960128 B (2.0 TB)
    |
    +-> Logical Volume Family 152CF806-8E3D-445A-9E44-56B676D2A871
        ----------------------------------------------------------
        Encryption Type:         AES-XTS
        Encryption Status:       Unlocked
        Conversion Status:       Converting (forward)
        High Level Queries:      Not Fully Secure
        |                        Passphrase Required
        |                        Accepts New Users
        |                        Has Visible Users
        |                        Has Volume Key
        |
        +-> Logical Volume FEE056B9-C321-4F84-8730-2A7A3F91EA9B
            ---------------------------------------------------
            Disk:                  disk6
            Status:                Online
            Size (Total):          1999683715072 B (2.0 TB)
            Conversion Progress:   60%
            Revertible:            Yes (unlock and decryption required)
            LV Name:               Seagate2TB
            Volume Name:           Seagate2TB
            Content Hint:          Apple_HFS

[Re-Titled by Moderator]

MacBook Pro 16″

Posted on Jan 22, 2025 7:11 AM

Reply

Answer 1

HWTech

Level 9

62,342 points

Jan 22, 2025 1:10 PM in response to jackradema

I would not try to modify the TM backup drive in any way or you risk damaging the backup. It is unlikely that the encryption is the problem. Besides reverting the encryption will be very hard on the hard drive, plus if it never finishes, then you may have complicated getting access to the data.

I would be concerned that the old hard drive may be failing. I would suggest checking the health of the hard drive by running the third party app DriveDx (free trial period) and posting the complete DriveDx text report here using the "Additional Text" icon which looks like a piece of paper on the forum editing toolbar. You will need to install a special USB driver in order to access the health information on the external drive.

Also, are you trying to use the Finder to look at the TM backup, or are you using the Time Machine interface? You should be using the TM interface to navigate the backups.

Reply

Answer 2

jackradema Author

Level 1

4 points

Jan 22, 2025 3:19 PM in response to HWTech

I have a new laptop now so the time machine on this laptop is not configured to look for this specific disk. I have only been able to inspect the drive once: I entered the password 3 times in between intervals of around 20 min, then it mounted and showed up in finder, where I was able to browse both my old data written as regular folders and the Backups.*** folder which I believe is where the TM backups are stored, albeit very slowly (folders took around 1-2 mins to open).

However I can't replicate this. I will try the DriveDx approach.

Reply

Answer 3

g_wolfman

Level 4

2,536 points

Jan 22, 2025 7:14 PM in response to jackradema

Your disk never finished fully encrypting. You can see that on the output from your terminal. It's Conversion Status is Converting (forward) and the progress is 60%. It's in a halfway state and now also many years old.

I would try to get it to mount again, and pull the files off if you can get it to mount. Unless there is a good reason, abandon the Filevault backups (which I assume are now years out of date and probably you are backing up elsewhere?). By a new external disk.

And as far at my advice goes, you will probably want to try something like DriveDx as already suggested by HWTech as part of the "try to get it to mount again" step.

Reply