(Rich Trouton wrote up an extensive blog entry on the recovery process in 2015 that remains valuable.)Įrase via Recovery. Apple has full instructions at the bottom of this page, but it requires that you either cached your password in iCloud-which doesn’t work for another party who doesn’t have access to your account-or the person who enabled FileVault created a recovery key that they can provide to you. If you don’t have a valid password, you can try to recover one. However, each email I’ve received sounded fully plausible, and most had personal details attached.)

(Now if I were suspicious, I’d wonder if the emails I’ve received were from people who had obtained systems illegitimately, and were trying to crack into them or reformat a system that they’d potentially obtained through another party who might not have had full authority to give it to them. When the computer reboots, the password is put in multiple memory locations within a fixed memory range, making it readable by hacking devices.ĭubbed PCILeech and costs approximately $300, the hacking device exploits these two vulnerabilities to carry out DMA attacks and extract Mac FileVault2 passwords from a device's memory in clear text before macOS boots, and anti-DMA protections come into effect.You can recover a lost FileVault password or erase a FileVault drive, losing everything but regaining the ability to use the system. Secondly, the password to the FileVault encrypted disk is stored in clear text in memory, even when the computer is in sleep mode or locked. It's because the Mac EFI or Extensible Firmware Interface (similar to a PC's BIOS) let devices plugged in over Thunderbolt to access memory without enabling DMA protections, which allows Thunderbolt devices to read and write memory. The first issue is that the Mac system does not protect itself against Direct Memory Access (DMA) attacks before macOS is started.

The researcher devised this technique by exploiting two designing flaws he discovered last July in Apple's FileVault2 full-disk encryption software. Here's How an Attacker can steal your Mac FileVault2 Password So, next time when you leave your Apple's laptop unattended, be sure to shut it down completely rather than just putting the system in sleep mode or locked.

Forgot macbook encryption password