FileVault The Secure Enclave And Apple Encryption

Frequently asked questions

Can you break File Vault or extract the key from the chip?

No, and a reputable expert will not claim to (§4, §6). FileVault's encryption is strong and the key is protected in hard w are by the Secure Enclave, which cannot be defeated by direct attack or by extracting the key. The realistic route is never cryptanalysis but authentication: obtaining the user's credential by cooperation or order, or a lawful recovery key. Anyone promising to break the encryption should be treated with caution; the honest and effective approach is to find a lawful way to authenticate.

What is a File Vault recovery key, and why does it matter?

It is a key created when File Vault is enabled that can unlock the disk instead of the password (§5). It matters because it is a clean, lawful route into an encrypted device that avoids any need to break anything. The practical task is to find where it lives: the user may hold it, an or g an is at i on may hold an institutional one for a managed device, or it may be escrowed in the user's iCloud account. Locating a recovery key often opens a device that otherwise looked inaccessible.

Why can't you just copy the disk and decrypt it else where?

Because the encryption is bound to the machine (§3, §4). The keys are tied to that specific Secure Enclave, so the encrypted storage cannot be moved to another computer and decrypted there, the classic imaging workaround does not work. Decryption happens only on the original machine, and only on authentication. This machine-binding is a core reason the old forensic methods fail on Apple devices and why access is about authenticating on the device itself, not about the disk.

The device is company-owned. Does that help?

Often significantly (§5, Example 2). A corporate or managed Apple device is frequently enrolled in a device- management system, and the or g an is at i on may hold an institutional File Vault recovery key or the means to unlock it. As owner and administrator, the employer can law full y provide access, without compelling the individual or attacking the encryption. So establishing how a device is managed is an early and valuable question, the or g an is at i on is often the cleanest lawful source of access to a managed device.

If the device is locked and no key exists, is the data gone?

The device itself may be inaccessible, but the evidence often is not (§6, §8, Example 3). Honesty requires acknowledging that a locked or powered-off device with no credential or recovery key cannot be opened by direct means. But the data frequently lives else where in the Apple estate: iCloud holds synced files, mail, messages and photos, and a paired iPhone or iPad holds much of the same, reachable through the account by lawful process. So a closed device redirects the enquiry to the estate rather than ending it.

Why does it matter that a recovery key is escrowed in iCloud?

For two reasons (§5, §7, Example 1). Practically, an escrowed key can be obtained through the proper account process and used to unlock the device law full y, a clean route in. Evidentially, the very existence of an escrowed recovery key in an account is itself a finding: it establishes a lawful means of access and can be significant to how the matter proceeds. So establishing whether a key is escrowed, and obtaining it properly, is often the decisive step with an otherwise locked device. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17