Apple T2 chip data recovery: How to recover lost data from T2-secured Mac?

Updated by Tim to Mac Data Recovery Tips on October 23th, 2020

MacBook 2018, 2019 and 2020 are the most powerful MacBook till date, it has a built-in T2 security chip for encrypted storage and secure boot.

Despite its fantastic configuration, MacBook 2018, 2019 and 2020 are not immune to data loss situations. This article will help you to recover deleted or lost file from MacBook Pro/Air 2018, 2019 and 2020.

How to check if your Mac has a Apple T2 security chip?

Read our article: Does my Mac has a T2 security chip to check if your Mac has a Apple T2 security chip.

How to recover lost data from Mac equipped with Apple T2 security chip?

There are five methods you can have a try to recover lost data from Mac with Apple T2 security chip:

Method 1: Using Apple T2 chip data recovery software

The Apple T2 chip data recovery process is different from the common data recovery, depending on your Apple T2 security chip equipped Mac. Once the Macintosh HD is left from your Apple T2 security chip equipped Mac, the T2 chip data recovery is impossible.

To recover data from T2 chip equipped Mac, you must find a professional T2 chip data recovery software. Otherwise, there is no way to decrypt data from that T2 security chip equipped Mac.

T2 chip data recovery software

As a professional Mac data recovery software, M3 Data Recovery for Mac supports Apple T2 chip data recovery.

Tutorial to recover data from T2 chip secured Mac:

To recover data T2 chip equipped Mac, you need to run M3 Data Recovery on that T2-secured Mac with the following steps:

Step 1: Boot your T2-secured Mac into Internet Recovery mode by pressing Option + Command + R keys at startup.

Step 2: After seeing macOS Utilities, click Utilities in the top menu and select Terminal from the drop-down menu.

Run Terminal in macOS Recovery mode

Step 3: Type the following command and press Return to load M3 Data Recovery for Mac.

sh <(curl boot.m3datarecovery.com/boot.sh)

Please notice there are two spaces in the above command, one space after sh, another space after curl.

Step 4: After loading M3 Data Recovery for Mac, select Macintosh HD volume to scan the lost data.

If you have not enabled FileVault, M3 Data Recovery for Mac will automatically scan the selected Macintosh HD. If you have enabled FileVault, M3 Data Recovery for Mac will prompt you to enter the password or recovery key.

Method 2: Recover lost data from Time Machine backup

Time Machine is a built-in backup tool which can automatically back up all of your files. If you have enabled Time Machine backup, you can restore the lost files from Time Machine backups.

Step 1: Connect the backup drive to your Mac computer.

Step 2: Open the folder that once contained your deleted files.

Step 3: Click the Time Machine icon in the top left menu bar and select Enter Time Machine.

Step 4: Browse the items in the backup folder by using on-screen up/down arrows or using the timeline at the edge of the screen. If you want to find files of the older version, using timeline to navigate the files is faster. You will be able to see a lot of snapshots of this whole folder and how the folder changes.

Step 5: Select an item and press Space bar or double-click it to preview it.

Step 6: Select the file you want to restore, and then click Restore.

Method 3: Apple T2 chip data recovery by MacQuisition

MacQuisition is the only solution that interfaces with the T2 chip to decrypt the filesystem at collection time, providing a decrypted physical image.

MacQuisition has the ability to create a physical decrypted image of a Mac with T2 chip in 5 steps:

Step 1: Handle secure boot settings.

Step 2: Boot to MacQuisition.

Step 3: Click on Image Device view.

Step 4: Select image options.

Step 5: Click on Image Device button.

More details: How to use MacQuisition to create a physical decrypted image of Mac with T2 chip?

Method 4: Apple T2 chip data recovery by Passware Kit

Passware Kit Forensic for Mac features a new built-in tool that unlocks APFS disks from Mac computers protected with T2 chip if the iCloud recovery option was enabled. The tool requires either iCloud credentials or iOS backup of the same Apple ID.

Passware Kit Forensic for Mac runs from a Mac connected to the target computer via thunderbolt/USB-C, unlocks the APFS disk via iCloud recovery, and mounts it to the customer's Mac in a read-only mode.

Method 5: Recover data from the failed Mac by Apple store

Apple has documented a new data recovery process internally for Macs that utilize its T2 chip introduced with the iMac Pro and the 2018 MacBook Pro.

To complete the process, Apple's repair staff will use a Thunderbolt (USB-C) to Thunderbolt 3 (USB-C) or Thunderbolt 3 (USB-C) to USB-A cable and another host computer as well as an external hard drive where the data will be transferred. From there the machines can be put into DFU mode and the data recovery process can be initiated from within Apple's internal diagnostics tool.

Related articles: