Skip to content 
FileVault
In brief
FileVault is the macOS built-in encryption of a Mac's entire startup volume. When it is active, the data is unreadable without the login password or recovery key. When decommissioning Macs, FileVault makes secure erasure easier, but does not replace removing locks such as Activation Lock and proof of erasure.
How FileVault works
FileVault encrypts all data on the startup volume. On Macs with an Apple chip or T2 security chip, the internal storage is hardware-encrypted by default; FileVault additionally ties access to the user's password. For emergencies there is a recovery key. Companies often store it in their MDM. The principle corresponds to the Hard drive encryption on other systems.
What to consider when decommissioning Macs
| Step | Why |
|---|---|
| Sign out of Apple Account | The Activation Lock is lifted |
| Release from Apple Business Manager and MDM | Otherwise the Mac remains assigned to your company |
| Erasing data verifiably | Proves the erasure per serial number |
FileVault generally does not have to be switched off before erasure. On Macs with an Apple chip or T2 chip, the "Erase All Content and Settings" function removes the keys of the encrypted storage and thereby makes the data unreadable. For companies, however, proof per device is missing. It is also important that the Mac does not remain locked. How locks on Apple devices are removed is shown by our guide Selling tablets without an MDM lock.
Second IT erases notebooks and mobile devices with Blancco and issues a digitally signed erasure certificate per device.
Frequently asked questions about FileVault
Do I have to disable FileVault before selling a Mac?
No. What matters is that the data is erased and the Apple Account, Activation Lock and MDM binding are removed.
What happens if the recovery key is missing?
Without a password or key, the data is no longer accessible. The Mac can still be erased, provided no lock is active.
Is FileVault the same as BitLocker?
Both encrypt the entire system drive. FileVault belongs to macOS, BitLocker to Windows.
How does FileVault work on Macs with an Apple chip?
On Macs with an Apple chip or T2 security chip, the internal storage is hardware-encrypted by default. FileVault additionally ties access to the user's password. During erasure the keys are removed, so the data is no longer readable.
Where is the FileVault recovery key stored?
The recovery key is intended for emergencies when the login password is missing. Companies often store it in their MDM. File it in a way that it can still be found after employees leave.
Decommission Macs – certified erasure, with proof per device.
Send us your device list. You will receive your offer in 48 hours on average.