Decryption of storages

Windows BitLocker encryption

UFS Explorer features embedded techniques for immediate decryption of storages protected by the BitLocker encryption solution built into Windows. The software will require the decryption password or recovery key to decipher the data available on the drive.

Alternatively, the drive can be unlocked in the operating system as per usual and then mounted in the storages navigation pane like a non-encrypted logical drive for further operations. Yet, this option is not recommended due to the possibility of data overwriting.

Unless decrypted using one of the mentioned options, the drive will remain unreadable, and any attempts to recover data from it will deliver no valid results.

However, it should be pointed out that decryption is possible only if the metadata area on the drive that keeps the BitLocker encryption keys is intact. When BitLocker doesn’t accept the correct decryption credentials, it may be the symptom of metadata corruption.

In order to perform decryption directly in the program, proceed as follows:

1. Select the needed BitLocker volume in the storages navigation pane. It will be displayed with a yellow padlock icon for easier identification.

   

   Please note that encrypted portable drives use BitLocker To Go instead of standard BitLocker and may show up as volumes with an encrypted file system, without the BitLocker label.

   

2. Launch the volume’s context menu and choose the "Decrypt encrypted volume" option.

   

3. In the opened dialog, enter the correct password or the 48-digit BitLocker recovery key into the respective field.

   

   If you decide to use the key, ensure that you copy it as it is from the backup file, including all the dashes.

   

   As the software handles the drive in a safe virtual mode, any number of tries can be made to unlock the storage, they won’t affect the actual encrypted device.

4. After you hit "OK", the decrypted volume will be mounted in the interface as a new virtual storage that can be processed like any ordinary drive.

   

Apple APFS encryption

UFS Explorer allows decrypting Apple volumes encrypted in Disk Utility using the native means of the APFS file system. For this, you will need to provide the password that has been applied to protect the device. Moreover, the parts of the drive that keep the essential information for decryption of the data has to be undamaged.

Please note that manipulations with the system drive require its connection to another computer as a secondary storage or booting your Mac with the help of a Live CD. Mac models that employ Apple’s M1 (Apple Silicon) or T2 security chips make it impossible to work with their internal drives.

To unlock an encrypted volume with APFS, carry out the following steps in UFS Explorer:

1. Find the necessary encrypted APFS volume in the storages navigation pane. It will be labeled with a yellow padlock icon.

   

   The data within it cannot be accessed until the correct password is provided.

   

2. For this, open the volume’s context menu and choose the "Decrypt encrypted storage" option.

   

3. In the opened dialog, specify the valid user password or paste the personal recovery key into the corresponding field, including all the dashes. After that, press the "OK" button.

   

4. If the authentication is accepted successfully, you will see a popup message, and the decryption state of the volume will be changed.

   

5. Following this, its data will be available for access.