Encrypted hard drive: how to decrypt it and recover your data

Hard drive encryption is a process that uses mathematical algorithms to convert the data on a disk into unreadable code, so that it cannot be accessed by unauthorized users.

If the data cannot be lost, talk to people who do this every day: see Bot’s hard drive data recovery, which starts with a free diagnosis.

Encryption can be done by software or by hardware.

Either way, to access an encrypted drive, the user has to provide a password, a fingerprint or a smart card.

In this post, you will learn more about disk encryption and the differences between software and hardware encryption.

You will also find out how to tell if your hard drive is encrypted, what the advantages of an encrypted drive are, and how to decrypt it and recover data from it.

01What is hard disk encryption?

Hard drive encryption is a technology that encrypts the data stored on a hard drive using sophisticated mathematical functions.

Nobody can read the data on an encrypted hard drive without the right key or password.

This prevents unauthorized access to the data, for example if the drive is lost or stolen, and adds a layer of protection against hackers and other threats.

The idea behind software-based hard drive encryption is quite simple: whenever a file is written to the drive, specialized software encrypts it automatically.

Unlike hardware-based encryption, it does not need any dedicated hardware to encrypt the drive.

When a file is read from the drive, the software decrypts it on the fly, while everything else on the drive stays encrypted.

Encryption and decryption are transparent to everyday applications such as word processors, databases and spreadsheets.

From the user’s point of view, a computer with an encrypted hard drive works just like any other computer.

Hardware encryption vs. software encryption

Both hardware and software encryption have pros and cons. Here is a closer look at each:

Software encryption

Software encryption usually relies on a password.

The principle is simple: enter the correct password and your files are decrypted; otherwise, they stay locked.

With encryption turned on, a special algorithm scrambles your data as it is written to the disk.

The same software then decrypts the data when an authenticated user reads it from the disk.

The main advantage of software encryption is that it is usually cheap to implement.

Software-based encryption also doesn’t require any additional hardware.

On the other hand, software encryption is only as secure as the rest of your computer or smartphone.

This means that if a hacker manages to find out your password, the encryption is immediately useless.

Software encryption tools also share your computer’s processing resources.

On older or less powerful computers, this can slow the whole system down while data is being encrypted or decrypted.

Finally, opening and saving encrypted files can be slower than normal because the process uses system resources, especially with stronger encryption settings on hardware without encryption acceleration.

Hardware encryption

Hardware encryption is built around a separate processor dedicated to authentication and encryption.

It is increasingly common in mobile devices; one example is the Secure Enclave in Apple iPhones, which works together with Face ID.

This technology still relies on a key to encrypt and decrypt the data, but the key is randomly generated by the encryption processor itself.

Hardware-encrypted devices often replace traditional passwords with biometric authentication (such as a fingerprint) or a PIN entered on a built-in keypad.

One advantage of hardware encryption is that it is more secure than software encryption, because the process is isolated from the rest of the device.

This makes it much harder to intercept or break.

A dedicated processor also takes the load off the rest of the device, making encryption and decryption much faster.

On the other hand, hardware-encrypted storage is usually much more expensive than a software tool.

For example, BitLocker is included free of charge in the Pro, Enterprise and Education editions of Windows, but an encrypted USB flash drive is quite expensive, especially compared with an unencrypted one.

Also, if the encryption hardware fails, it can be extremely difficult to regain access to your data.

02How do I know if my hard drive is encrypted?

Encrypting your data is good practice to protect the information on your PC from unauthorized access, as long as you keep the password and the recovery key in a safe place.

To find out if disk encryption is turned on in Windows, follow these steps:

• Click the “Start” menu;
• Click the gear icon to open “Settings” and select “Update & Security” (in Windows 11, “Privacy & security”);
• Click “Device encryption” (if this option doesn’t appear, check “BitLocker Drive Encryption” in the Control Panel);
• If you see the message “Device encryption is on” with the option “Turn off”, your hard drive IS encrypted;
• If encryption is NOT on, you can click “Turn on” to encrypt your device and follow the instructions. Save the recovery key somewhere other than the computer itself.

On a Mac, follow these steps to check if your hard drive is encrypted:

• Open “System Settings” > “Privacy & Security” and scroll to FileVault (on older versions of macOS, “System Preferences” > “Security & Privacy” > “FileVault”);
• If you see the message “FileVault is turned on for the disk ‘Macintosh HD’” with the option “Turn Off”, your disk IS encrypted;
• If the message says “FileVault is turned off”, your disk is NOT encrypted. You can click “Turn On” to encrypt it and follow the on-screen instructions.

03Benefits of self-encrypting hard drives

Here are the main advantages that hardware-encrypted (self-encrypting) drives offer users:

Better performance

The encryption hardware, built into the drive’s controller, lets the disk run at full speed with no loss of performance.

Strong hardware-based security

Encryption is always on and the encryption keys never leave the drive.

In addition, the drive itself authenticates the user before unlocking, regardless of the operating system.

Ease of use

Encryption is transparent to the user and doesn’t need to be turned on.

Self-encrypting drives can be wiped almost instantly by changing the built-in encryption key (cryptographic erase): the old data becomes unreadable without having to overwrite the whole drive.

Lower cost of ownership

There is no need for new infrastructure to manage encryption keys, as these drives can use your existing infrastructure to store recovery information.

Your device runs more efficiently because no processor cycles are used for encryption.

04How to decrypt an encrypted hard drive

To decrypt a drive, you need the password or the recovery key. On Windows, the standard way is through the Control Panel (BitLocker); on a Mac, through FileVault or the Terminal. Diskpart, on the other hand, does not decrypt anything: it can only erase the drive so that it can be reused.

Solution 1: decrypt the drive from the Control Panel (Windows)

This is the easiest way to decrypt a BitLocker-encrypted drive in Windows and keep your data.

Sign in with an administrator account and go to Control Panel > System and Security.

Then select “BitLocker Drive Encryption”.

You will see the encrypted drives and the options available for each one. If the drive is locked, unlock it first with the password or the recovery key.

Select the drive you want to decrypt and click “Turn off BitLocker”.

A window will appear: confirm by clicking “Decrypt drive” and wait while Windows decrypts it. This can take hours on large drives; do not turn off the computer or disconnect the drive in the meantime.

Solution 2: erase the drive with Diskpart (Windows), only if you don’t need the data

If you have lost the password and the recovery key and don’t need the data, Diskpart can wipe the encrypted drive so that you can use it again. Warning: this does not decrypt anything. The clean command deletes the partition table, and the data on the drive will be lost for good. Make sure you select the right disk:

• Type “diskpart” in the Windows search bar and run it as administrator;
• Type list disk and identify the encrypted drive by its size (make a note of its number);
• Type select disk 1, replacing 1 with the number from the previous step;
• Type clean (this erases the partition table of the selected disk) and then create partition primary;
• Type select partition 1, then format fs=ntfs quick, and finally assign to give the drive a letter;
• When the process is complete, type exit.

Decrypting an encrypted hard drive on a Mac

To decrypt your Mac’s internal disk, simply turn off FileVault in the settings shown above and wait for decryption to finish. To decrypt an encrypted external APFS volume, use the Terminal:

• Open the Terminal and type diskutil apfs list to find the identifier of the encrypted volume (for example, disk4s1);
• Press “Return” and check that the volume shows “FileVault: Yes”;
• Type diskutil apfs unlockVolume disk4s1 (with your identifier), press “Return” and enter the volume password;
• Then type diskutil apfs decryptVolume disk4s1 and enter the password again when prompted;
• Press “Return”. Decryption runs in the background; you can check its progress with diskutil apfs list.

Without the password or the recovery key, the data on an encrypted Mac disk cannot be decrypted. The only way to use the disk again is to erase it, which permanently destroys the data, so only do this if you don’t need it:

• Open Disk Utility and choose “View” > “Show All Devices”;
• Select the physical disk (not just the volume) in the sidebar and click “Erase”;
• Choose a name, the format (for example, APFS) and the “GUID Partition Map” scheme, then click “Erase” to confirm.

05How to recover data from an encrypted hard drive

In some cases, the data on a hard drive is encrypted maliciously, as in a ransomware attack, to block access to it.

Here is how data recovery companies handle these cases, and what to do if you are hit by ransomware.

Recovering data from an encrypted hard drive with a data recovery company

When a data recovery company recovers data from an encrypted hard drive, the procedure is extremely meticulous.

First, the technicians analyze the situation to find the safest and most cost-effective way to recover the encrypted data.

In ransomware cases, this involves a specific study of the type of ransomware, looking for security flaws and recovery possibilities.

This shows whether the encryption can be reversed to decrypt the data. If it can’t, a team of experts carries out an in-depth analysis of the file structure.

The aim is to find out whether the attack left any recoverable traces and to rebuild as many files as possible.

All viable procedures are then carried out to increase the chances of recovering the encrypted files as efficiently and safely as possible.

Decrypting a hard drive encrypted by ransomware

In short, ransomware is malware that uses encryption to hold the victim’s data for ransom.

In an attack, a user’s or organization’s critical data is encrypted so that they cannot access their files, databases or applications. A ransom is then demanded to restore access.

Ransomware is usually designed to spread across a network and target databases and file servers, quickly paralyzing an entire organization.

If you think you have been the victim of a ransomware attack and want to recover the encrypted files, the best thing to do is to contact a specialized professional service immediately. Disconnect the affected devices from the network, but don’t format them or try to clean them up first.

Incorrect procedures can make data recovery much harder.

This is a highly technical job that requires a detailed analysis of each case, carried out by specialists with extensive experience in recovering encrypted files.

After the infection has been analyzed, the encryption may be removed with a decryption tool, when one exists for that ransomware, or the files may be rebuilt using professional data recovery techniques.

Different types of ransomware require different tools. That’s why it is important to have the support of professionals who can identify the ransomware and choose the right approach.

06Conclusion

Hard drive encryption uses sophisticated mathematical functions to convert the data stored on a drive into a format that unauthorized people cannot read.

Without the right key or password, the data cannot be read.

Hardware-encrypted drives generally offer better performance, strong security, ease of use and a lower cost of ownership.

Hard drive encryption protects against hackers and other threats and comes in two types: software and hardware.

Each type has its own weaknesses, but used correctly, both are highly effective at keeping your data secure.

If you need to decrypt your drive, use BitLocker in the Control Panel (on Windows) or FileVault and the Terminal (on a Mac). Diskpart does not decrypt: it erases the drive.

In some cases, the data on your hard drive may be encrypted maliciously so that you can’t access it, as happens in ransomware attacks.

If you think you have been the victim of such an attack, it is vital to contact a professional data recovery service, such as Bot, as soon as possible.

Some ransomware can delete files after a certain time, so a quick response is crucial.

We offer 24/7 support, and our team will give you all the help you need to deal with the problem.

At Bot, our customers’ satisfaction with the result is one of our top priorities.

Our success rate is 96%, which reflects the quality of our work.

Start your recovery with us now!