Decrypting and recovering the user's FileVault-encrypted macOS

  1. Decrypt a volume formatted as APFS on macOS Mojave 10.14 and higher.
    1. Show the disk volumes on the macOS. 
      diskutil apfs list

      The volume to recover is the OS Volume. It has a name similar to disk2s1.

    2. Unlock the volume. 
      diskutil apfs unlockVolume <Disk Name> -passphrase <Personal Recovery Key>
    3. Get the list of apfs cryptousers. 
      diskutil apfs listcryptousers <Disk Name>

      For example:

      diskutil apfs listcryptousers disk2s1

      For a local user, select the UUID of the user that has:

      Type: Local Open Directory User

    4. Decrypt the volume. 
      diskutil apfs decryptVolume <diskname> -user <user UUID>
    5. Enter the password of the local user.
    6. Monitor the progress of the decryption. 
      diskutil apfs list
  2. Decrypt a volume formatted as CoreStorage on macOS 10.12 or higher.
    1. Unlock the volume. 
      diskutil cs unlockVolume <Logical Volume UUID> -passphrase <Personal Recovery Key>
    2. Allow access when prompted in the user interface.

      Enter the keychain password.

      The volume is now unlocked.

    3. Start the decryption. 
      diskutil cs decryptVolume <Logical Volume UUID>
    4. Enter the password for the local user when prompted.
    5. Monitor progress of the decryption. 
      diskutil cs list

The user can now reboot the macOS normally. They do not see the FileVault pre-boot screen.