BitLocker, FileVault, ne LUKS Disk Encryption a Wɔsan Yɛ Safoa a Wɔatoto mu¶

Sɛ wohu BitLocker Recovery screen bruu wɔ Windows so, FileVault login prompt a wɔatoto mu wɔ macOS so, anaasɛ ** a entumi nyɛ hwee .cryptsetup passphrase prompt** wɔ Linux adwumayɛbea so betumi ama w’adwuma ne w’ankasa asetra agyae. Full-disk encryption (FDE) de asraafo-grade symmetric ciphers di dwuma, mpɛn pii no AES-128 anaa AES-256 wɔ XTS mode mu, de frafra wo solid-state drive (SSD) anaa hard disk drive (HDD) no fã biara. Sɛ wonni cryptographic Volume Master Key (VMK) anaasɛ key-encryption protector a ɛfata a, akontaabu mu no, wontumi nhu nsonsonoe a ɛda raw data a ɛwɔ NAND flash chips no so ne dede a ɛba kwa no ntam.

Nanso, mpofirim recovery key screen ntaa nkyerɛ sɛ wo drive no asɛe anaasɛ wo key no ayera koraa. BitLocker ne FileVault lockouts dodow no ara fi ase ara kwa bere a BIOS/UEFI firmware update a wɔyɛ no daa, Thunderbolt dock nsakrae, Secure Boot toggle, anaa CMOS coin-cell battery a awu sesa Platform Configuration Registers (PCRs) a ɛwɔ wo motherboard mu no Trusted Platform Module (TPM 2.0). Sɛ mpo woankyerɛw recovery key da a, mpɛn pii no wubetumi atwa prompt no ho denam UEFI firmware nhyehyɛe pɔtee a ɛtwetwe TPM susuw no a wobɛsan de akɔ so, anaasɛ wobɛhwehwɛ wo key no ho backup a ɛyɛ komm wɔ w’ankasa Microsoft akontaabu mu, adwuma anaa sukuu Microsoft Entra ID directory, Apple iCloud keychain, anaasɛ volume shadow copy a wɔanhyɛ so.

--- .

Yɛ eyi mprempren¶

1. GYINA ansa na woakliki "Reset this PC", "Erase Mac", anaasɛ wobɛhyehyɛ mpaepaemu no. Sɛ wosan instɔl Windows, macOS, anaa Linux wɔ nkyekyɛmu a wɔabɔ no kokoam so a, ɛkyerɛw cryptographic volume header (BitLocker metadata blocks, APFS container superblock, anaa LUKS2 JSON header) no so. Sɛ wɔkyerɛw saa metadata ti ketewa no so wie a, sɛ wuhu wo digit 48 recovery key a ɛfata ɔkyena mpo a, ɛremma wo fael ahorow no nkɔ bio.
2. Yi abɔnten USB drives, SD cards, Thunderbolt docks, HDMI adapters, ne gaming controllers nyinaa, afei san bɔ. Wɔ Windows nhyehyɛe ahorow a wɔde TPM 2.0 Platform Configuration Registers (titiriw PCR 0, PCR 2, PCR 4, ne PCR 7) di dwuma so no, fa USB thumb drive a wotumi bɔ, Thunderbolt dock a wɔde abata ho foforo a Option ROM firmware, . anaasɛ abɔnten monitor hub betumi asesa pre-boot hash susuw. Sɛ woyi peripheral biara fi mu na wotaa yɛ cold reboot a, ɛma TPM no gyae Volume Master Key no sɛnea ɛte biara a enhia 48-digit code no.
3. Hwɛ Microsoft, Apple, anaa adwumakuw akontaabu biara a wode adi dwuma pɛn wɔ fon anaa laptop a ɛto so abien so. Mfa no sɛ wunim email akontaabu a na ɛyɛ adwuma bere a wodii kan yii laptop no adaka mu no. Wɔ Windows so no, hwɛ account.microsoft.com/devices/recoverykey across your personal Outlook/Hotmail/Live accounts, and check aka.ms/myrecoverykey on any work, university, or client Microsoft 365 (Entra ID) account you ever signed into inside Microsoft Word, Teams, or Windows Settings.
4. Match the first 8 characters of the "Key ID" displayed on your locked screen. A Windows BitLocker recovery screen displays a 32-character Key ID (or the first 8 hexadecimal characters, such as A1B2C3D4). If you have multiple keys stored in your Microsoft account or on old computers, only the 48-digit recovery password whose Key ID matches those exact 8 characters will unlock this specific drive volume.
5. San BIOS/UEFI nsakraeɛ biara a woayɛ nnansa yi ansa na wɔatoto no. Sɛ BitLocker screen no pueiɛ ntɛm ara wɔ berɛ a wohyɛn BIOS nhyehyɛeɛ mu sɛ wobɛdum Secure Boot, toggle CSM (Compatibility Support Module), sesa Intel PTT / AMD fTPM, anaa ma ** Boot Order nsakraeɛ** nyɛ adwuma, san hyɛ aseɛ kɔ BIOS (F2, . F12, anaa Del) and set those exact toggles back to their prior state. As soon as PCR 7 and PCR 0 match their original cryptographic hash, the TPM will unseal the key automatically.
6. Fa honam fam ahobanbɔ di kan sɛ lockout no ba wɔ ntɛm anaa ofie ahokyere mu a. Sɛ worebɔ mmɔden sɛ wobɛgye aduruyɛ ho kyerɛwtohɔ, sikasɛm ho nkrataa, anaa nhyehyɛe a wode bɛtu afi hɔ wɔ ɔhaw bi mu a, kae sɛ encrypted drives kura data daa bere a wɔadum anyinam ahoɔden no. Sɛ wuhyia honam fam ahunahuna ntɛm ara a, gyaw hardware no na frɛ wo mpɔtam hɔ nɔma a egye ntɛmpɛ (911 wɔ United States ne Canada, 112 wɔ Europa Aman Nkabom no nyinaa mu, 999 wɔ United Kingdom, anaa hwɛ yɛn nɔma ahorow a egye ntɛmpɛ nkyerɛwde a wɔde kyerɛw nsɛm).

--- .

Disk encryption lockout triage and recovery decision tree¶

flowchart TD
    Start["Locked Out of Encrypted Drive: BitLocker, FileVault, or LUKS Prompt"] --> WhichOS{"Which Operating System and Encryption Engine?"}

    WhichOS -->|"Windows: BitLocker 48-Digit Recovery Screen"| PeriphCheck["Step 1: Unplug all USB drives, Thunderbolt docks, and external monitors; cold reboot"]
    PeriphCheck --> StillLocked{"Still asking for 48-digit key?"}
    StillLocked -->|"No: Booted Normally"| BackupNow["Immediately run 'manage-bde -protectors -get C:' and save 48-digit key offline"]
    StillLocked -->|"Aane"| BIOSCheck{"Did you just change BIOS, Secure Boot, CSM, or update firmware?"}

    BIOSCheck -->|"Aane"| RevertBIOS["Enter UEFI Setup: Re-enable Secure Boot, UEFI Boot Mode, and Intel PTT / AMD fTPM to restore PCR 7 hash"]
    BIOSCheck -->|"Dabi"| HuntKey["Step 2: Match 8-Char Key ID across ALL Personal Microsoft Accounts, Work/School Entra ID, Active Directory, and USB .BEK/.TXT files"]
    RevertBIOS --> HuntKey

    WhichOS -->|"macOS: FileVault Login Rejects Password"| ApplePath{"Apple Silicon/T2 Mac vs Intel Mac?"}
    ApplePath -->|"All Macs"| TestLayout["Step 1: Check Input Menu in top-right of FileVault screen for keyboard layout mismatch"]
    TestLayout --> FVMethod{"Which Recovery Method Was Enabled?"}
    FVMethod -->|"iCloud Account Escrow"| BootRecovery["Boot to macOS Recovery: Authenticate with Apple Account via Recovery Assistant to reset password"]
    FVMethod -->|"24-Char Personal Recovery Key (PRK) or MDM"| EnterPRK["Enter XXXX-XXXX-XXXX-XXXX-XXXX-XXXX key in Recovery Assistant or request Institutional Escrow Key from IT"]

    WhichOS -->|"Linux: LUKS / cryptsetup Passphrase Rejected"| LUKSPath["Step 1: Drop to initramfs shell or boot Live USB; check keyboard layout in console"]
    LUKSPath --> LUKSHeader{"Are Keyslots Intact in 'cryptsetup luksDump'?"}
    LUKSHeader -->|"Yes: Keyslot Active"| TestPass["Test secondary keyslots (Slot 1-7), FIDO2/TPM2 token, or run hashcat Mode 29500 against header backup"]
    LUKSHeader -->|"No: Header Corrupted"| RestoreHeader["Restore LUKS header from '--header-backup-file' or scan disk for surviving metadata"]

--- .

Understanding Full-Disk Encryption and TPM 2.0 sealing¶

Neither Windows BitLocker, Apple FileVault 2, nor Linux dm-crypt / LUKS encrypts your SSD directly with your login password or recovery key. Instead, all three platforms use a two-tier key hierarchy:

1. The Volume Master Key (VMK) / Full Volume Encryption Key (FVEK): A hardware random key (128-bit, 256-bit, or 512-bit) encrypts and decrypts the actual disk sectors on the fly.
2. Key Protectors / Keyslots (KEKs): The Volume Master Key is wrapped using independent Key Encryption Keys (KEKs), called Key Protectors in BitLocker, Key Bags in Apple APFS, and Keyslots in Linux LUKS.
3. Why TPM 2.0 sealing locks you out on Windows: On Windows 10 and 11, the primary key protector is the Trusted Platform Module (TPM 2.0) chip (discrete silicon or firmware Intel PTT / AMD fTPM). When BitLocker seals the Volume Master Key into the TPM, it binds the key to specific Platform Configuration Registers (PCRs):
4. PCR 0: Hashes core UEFI/BIOS system firmware.
5. PCR 2: Hashes pluggable external hardware Option ROM code (Thunderbolt docks, RAID cards, external GPUs).
6. PCR 4: Hashes the boot manager (bootmgfw.efi) and boot order state.
7. PCR 7: Hashes Secure Boot policy and UEFI db / . dbx certificate databases.
8. PCR 11: Hashes BitLocker access control components.

Whenever you press the power button, the motherboard measures these firmware components before Windows loads. If any single bit in PCR 0, PCR 2, PCR 4, or PCR 7 differs from the value recorded when BitLocker was sealed, the TPM refuses to release the Volume Master Key and forces Windows Boot Manager to display the 48-digit BitLocker Recovery Key screen.

Comparison of Full-Disk Encryption architectures and recovery mechanisms¶

--- .

Ɔfa 1: Windows BitLocker sanba lockouts a wosiesie¶

Sɛ wo Windows PC gyina "BitLocker: Hyehyɛ recovery key ma drive yi" (anaasɛ Windows Recovery Environment bisa safoa ansa na ama Command Prompt anaa Safe Mode kwan ama kwan), yɛ adwuma fa saa tracks abien a ɛne ne ho di nsɛ yi so: Track A bɔ mmɔden sɛ ɛbɛdaadaa TPM no ma wabue draibɛ no a enhia safoa no, na Track B bɔ safoa a ɛwɔ digit 48 no ase wɔ biara mu dijitaal ne mpɔtam hɔ nneɛma a wɔkora so.

Track A: Bypassing BitLocker prompt a enni recovery safoa (Restoring TPM PCR tebea) .¶

If you did not manually wipe the TPM or move the NVMe SSD into a new motherboard, the Volume Master Key is still inside your TPM 2.0 chip. It is refusing to unlock because a pre-boot PCR measurement changed. Try these non-destructive hardware and firmware restores in order:

1. Twa abɔnten hardware ne docks nyinaa mu:
2. Power the computer completely off (hold the power button for 10 seconds).
3. Unplug every USB flash drive, external hard drive, USB-C hub, Thunderbolt docking station, SD card, and external monitor cable.
4. Unplug the AC charger for 15 seconds, plug the native charger directly into the laptop, and turn it on. Thunderbolt docks and USB-C hubs frequently contain internal PXE network boot or display Option ROMs that extend into PCR 2 and PCR 4, invalidating the TPM state.
5. Restore Secure Boot and UEFI Boot Mode in BIOS Setup:
6. Reboot na mia wo motherboard BIOS safoa (F2 on Dell/ASUS/Lenovo/Acer, F10 on HP, Del on desktop boards).
7. If Secure Boot was recently changed from Enabled to Disabled, set it back to Enabled (Standard Mode) and save changes. Conversely, if a BIOS update flipped Secure Boot to Enabled, try toggling it to Disabled once.
8. Confirm Boot Mode is set to UEFI Only (disable Legacy / CSM) and confirm Windows Boot Manager is the first boot option.
9. Verify Intel PTT or AMD fTPM is enabled (Never click "Clear TPM"):
10. After a dead CMOS battery or a BIOS reset, motherboards sometimes disable the firmware TPM (Intel Platform Trust Technology anaasɛ AMD CPU fTPM). Go to the Security or Trusted Computing tab in BIOS and confirm TPM 2.0 State is Enabled.
11. Warning: Never select "Clear TPM" or "Erase fTPM NV" inside BIOS. Clearing the TPM permanently destroys the internal Storage Root Key inside the silicon chip, making the 48-digit recovery key mandatory.
12. Roll back a buggy BIOS capsule update:
13. On Dell laptops, hold Ctrl + Esc while plugging in AC power to launch the Dell BIOS Recovery menu and select Rollback BIOS. On HP laptops, hold Win + B while pressing the power button for 2 seconds to trigger HP Sure Start BIOS rollback.

Track B: Exhaustive search for your 48-digit BitLocker Recovery Key¶

If the TPM cannot be restored (or if you moved the SSD into an external USB enclosure), you must supply the 48-digit numeric recovery password (XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX) or a .BEK startup key file. Write down the first 8 characters of the Key ID shown on screen (for example, Key ID: 4F8A9C12) and check these six locations:

1. Personal Microsoft Accounts (account.microsoft.com/devices/recoverykey) .¶

Visit https://account.microsoft.com/devices/recoverykey (anaasɛ https://aka.ms/myrecoverykey) on a phone or secondary computer. - Check every historical account: Device Encryption backs up the key to whichever Microsoft Account was first used when the PC was unboxed, even if you later switched to a local login. Sign in and test all old @hotmail.com, . @live.com, . @outlook.com, or linked @gmail.com accounts, plus the account of any spouse, parent, or technician who helped set up the PC or signed into Microsoft Office or Xbox Game Pass on that machine.

2. Adwuma, Sukuu, anaa Sukuupɔn Entra ID / Azure AD (myaccount.microsoft.com) .¶

Wɔ ankorankoro fie laptop so mpo no, sɛ wokɔ Microsoft 365 apps (Word, Excel, Teams) mu da a wode adwuma, sukuupɔn, anaa afɛfo email address na wogyaw "Ma m'ahyehyɛde no kwan ma ɛnhwɛ me mfiri so" a, Windows de wo BitLocker recovery key no kɔ saa ahyehyɛde no Microsoft Entra ID tenant no mu ankasa: 1. Visit https://myaccount.microsoft.com/device-list na fa w’adwuma anaa sukuu email kɔ mu. 2. Paw wo kɔmputa din na klik Hwɛ BitLocker safoa. 3. Sɛ w’adwuma anaa sukuu akontaabu no ayɛ adwuma dedaw a, frɛ saa ahyehyɛde no IT Help Desk na fa wo 8-character Key ID ma wɔn. Administrators betumi agye safe ama akontaabu a wɔagyae mu wɔ Devices > All devices > Recovery keys wɔ entra.microsoft.com.

3. On-Premises Adwumakuw Active Directory ( .msFVE-RecoveryInformation) .¶

Sɛ wɔde kɔmputa no kaa Active Directory domain ho a, Domain Administrator betumi ahwehwɛ safoa no denam ne Key ID a ɛwɔ nkyerɛwde 8 no so denam PowerShell so:

Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -Properties msFVE-RecoveryPassword, whenCreated |
  Where-Object { $_.Name -like "*4F8A9C12*" } | Select-Object Name, msFVE-RecoveryPassword, whenCreated

4. Automated anaa Manual Text Files a ɛwɔ USB Flash Drives ne Cloud Drives so¶

Sɛ Windows de recovery key sie fael anaa USB drive bi mu a, ɛto fael no din BitLocker Recovery Key [GUID].txt anaasɛ ɔkora ahintaw bi so .BEK faale (attrib +h +s). Fa PowerShell hwehwɛ yi kɔ USB draibɛ, abɔnten hard drive, OneDrive, Google Drive, ne Dropbox folda nyinaa so wɔ PC foforo so:

Get-PSDrive -PSProvider FileSystem | ForEach-Object {
    Get-ChildItem -Path $_.Root -Include "*BitLocker*Recovery*Key*.txt", "*.bek" -Recurse -Force -ErrorAction SilentlyContinue
} | Select-Object FullName, LastWriteTime

5. Safoa a Wɔde Yi Data Drive a Ɛto so Abien (D:) a efi Unlocked bi mu C: Nkyekyɛmu¶

Sɛ C: boots normally na ɛyɛ secondary drive nkutoo D: wɔatoto mu, bue Administrator PowerShell mfɛnsere bi wɔ so C: na tu mmirika manage-bde -protectors -get D: sɛ wobɛhwɛ sɛ C: da so ara kura auto-unlock registry key no, anaa hwehwɛ Volume Shadow Copies a atwam a ɛwɔ wo Documents folda a wɔde bɛpopa BitLocker Recovery Key *.txt fael ahorow.

6. Print Spooler Abakɔsɛm ne PDF / OneNote Printouts¶

Sɛ wo klik "Print the recovery key" bere a woreyɛ nhyehyɛe a, hwɛ Microsoft OneNote na hwehwɛ wo Documents folda a wɔde ma .pdf anaasɛ .xps fael ahorow a wɔayɛ denam "Microsoft Print to PDF" so.

Track C: BitLocker draibɛ bi a wobɛbue na woayi afiri WinRE Command Prompt (manage-bde) .¶

Sɛ wokyerɛw 48-digit recovery password wɔ blue screen no so loops san kɔ BitLocker wɔ reboot a edi hɔ no mu anaasɛ ɛbɔ Windows a, bue na gyae BitLocker fi Windows Recovery Environment (WinRE) Command Prompt:

1. Mia ** so .Esc** wɔ BitLocker screen no so, afei klik Skip this drive -> Troubleshoot -> Advanced options -> Command Prompt.
2. Hwɛ tebea no na bue OS volume no (C:): .

   manage-bde -status
   manage-bde -unlock C: -RecoveryPassword 123456-123456-123456-123456-123456-123456-123456-123456
   

   (Anaasɛ fa binary bue .BEK fael a ɛwɔ USB stick a wɔayɛ ho mfonini sɛ F: fa manage-bde -unlock C: -RecoveryKey "F:\key.BEK"). .
3. Suspen protectors sɛnea ɛbɛyɛ a prompt no nsan mma bio wɔ reboot a edi hɔ no so:

   manage-bde -protectors -disable C:
   

   Reboot kɔ Windows mu, afei tu mmirika manage-bde -protectors -enable C: wɔ Command Prompt a ɛkorɔn mu sɛ wobɛsan asɔ Volume Master Key no ano atia UEFI PCR hashes foforo no.
4. Sɛ Windows ntumi nhyɛ ase a, kɔpi fael ahorow no anaasɛ decrypt koraa:

   robocopy C:\Users\YourUsername F:\RescueBackup /E /ZB /R:1 /W:1 /XJ
   manage-bde -off C:
   

Track D: BitLocker SSD a wode bɛhyɛ Linux so (dislocker / . cryptsetup) de gye fael ahorow¶

Sɛ wo Windows motherboard wu a, fa M.2 NVMe anaa SATA SSD no gu abɔnten USB-C enclosure (a ne kɛse bɛyɛ sɛntimita 10 ne sɛntimita 3, anaa nsateakwaa 4 ne nsateakwaa 1.2) mu na bue no wɔ Linux PC anaa Ubuntu Live USB biara so:

# Method 1: Modern cryptsetup (v2.3+ natively supports BITLOCKER volumes)
sudo cryptsetup open --type bitlocker /dev/nvme0n1p3 bitlocker_unlocked
# Type the 48-digit recovery key INCLUDING hyphens when prompted
sudo mkdir -p /mnt/windows_data
sudo mount -t ntfs3 -o ro /dev/mapper/bitlocker_unlocked /mnt/windows_data

# Method 2: Using dislocker
sudo apt update && sudo apt install -y dislocker ntfs-3g
sudo mkdir -p /mnt/dislocker_raw /mnt/windows_rescue
sudo dislocker -V /dev/nvme0n1p3 -p123456-123456-123456-123456-123456-123456-123456-123456 -- /mnt/dislocker_raw
sudo mount -t ntfs-3g -o loop,ro /mnt/dislocker_raw/dislocker-file /mnt/windows_rescue

--- .

Ɔfa 2: Apple macOS FileVault 2 ne Secure Enclave lockouts a wɔbɛsiesie¶

Wɔ macOS (High Sierra nam macOS Sequoia ne foforo so), FileVault 2 de encrypt APFS (Apple File System) volume no nyinaa. Wɔ Macs a ɛwɔ Apple Silicon (M1, M2, M3, M4) anaa Apple T2 Security Chip so no, nokwarem no, wɔde wɔde encrypt volume no bere nyinaa wɔ ahomegye mu denam hardware keys a ɛwɔ Secure Enclave Processor (SEP) no mu so. Sɛ wodan FileVault a, ɛde Key Encryption Key (KEK) a wonya fi wo macOS login password ne wo FileVault Recovery Key mu no kyekyere saa hardware Volume Encryption Key (VEK) no.

Because FileVault requires decrypting the APFS volume before macOS loads from disk, the first screen you see when you turn on a FileVault-enabled Mac is not the normal macOS login window, it is the pre-boot FileVault EFI / iBoot unlock screen.

Anamɔn 1: Yi #1 a ɛde FileVault lockouts mpofirim ba no fi hɔ (Pre-boot keyboard nhyehyɛe & abɔnten keyboards) .¶

Ansa na wobɛfa no sɛ wo password no asɛe anaasɛ wobɛhyɛ aseɛ reset no, hwɛ saa pre-boot quirks mmiɛnsa yi a ɛma password a ɛfata wosow na ɛpow wɔ FileVault boot screen no so:

1. Pre-boot Keyboard Input Menu Switch: Pre-boot FileVault screen no de firmware keyboard draiver a wɔayi afi mu a ɛtaa yɛ default sɛ U.S. QWERTY (anaa ABC) sɛ mpo wode UK, German (QWERTZ), French (AZERTY), anaa Dvorak nhyehyɛe a ɛwɔ macOS mu na ɛkyerɛw wo password a. Hwɛ FileVault login screen no atifi nifa so, klik Keyboard Input menu icon no so, na paw wo keyboard nhyehyeɛ pɔtee.
2. Bluetooth Keyboard Timing & Num Lock: Bluetooth keyboards a ɛto so abiɛsa taa tow wɔn keystroke abien a edi kan bere a wɔsɔre wɔ pre-boot screen no so, anaasɛ enni Num Lock tebea kyerɛwtohɔ ahorow. Fa wired USB keyboard hyɛ Mac no mu tẽẽ (anaasɛ fa MacBook keyboard a ɛwɔ mu no di dwuma) na kyerɛw brɛoo.
3. Admin Users pii wɔ Mac Koro So: Wɔ FileVault mu no, macOS dwumadie akontaabuo biara a wɔama ho kwan no wɔ n’ankasa cryptographic token a ɛde ne ho wɔ APFS Key Bag (diskutil apfs listCryptoUsers /). Sɛ wo akonta wosow na ɛdi nkoguo a, klik ** Administrator user icon foforo** wɔ FileVault screen no so na fa wɔn password kɔ mu. Sɛ wokɔ macOS mu pɛ a, saa admin no betumi asan ahyɛ wo password no wɔ System Settings > Users & Groups mu.

Anamɔn 2: Bue FileVault denam Apple Akontaabu (iCloud) anaa 24-Nkyerɛwde Ankorankoro Recovery Safoa¶

Sɛ wo password da so ara di nkogu wɔ FileVault login screen no so a:

1. Twɛn Recovery Prompt: Bere a woakyerɛw password a ɛnteɛ mprɛnsa wɔ FileVault login screen no akyi no, macOS bɛkyerɛ akwan horow a wobɛfa so de wo Apple Account no asan asiesie anaasɛ wode wo Recovery Key bɛhyɛ mu.
2. Anaasɛ boot tẽẽ kɔ macOS Recovery (Recovery Assistant):
3. Apple Silicon Macs (M1/M2/M3/M4): Due koraa, afei mia na kura Power (Touch ID) button no mu sikani 10 kosi sɛ "Loading startup options..." bɛda adi, klik Options, na klik Continue.
4. Intel Macs: Dane Mac no na kura ** .Command (⌘) + R** kosi sɛ Apple ahyɛnsode no bɛda adi.
5. Wɔ mu Reset Password Recovery Assistant mfɛnsere:
6. Fa Wi-Fi a ɛwɔ screen no atifi nifa so no di nkitaho anaa fa Ethernet hyɛ mu.
7. Option A (Apple Account Escrow): If you enabled iCloud recovery, select Forgot all passwords? -> Sign in with Apple Account. Enter your Apple Account email, password, and 6-digit 2FA code (if you lost your phone, see our MFA lockout ne authenticator a wɔsan nya akwankyerɛ) de bue APFS volume no na wode password foforo si hɔ.
8. Option B (24-Character Personal Recovery Key): Select Enter FileVault Recovery Key and type your 24-character alphanumeric code (XXXX-XXXX-XXXX-XXXX-XXXX-XXXX).
9. Option C (Corporate / University MDM Escrow): If your Mac is managed via Jamf Pro, Kandji, Mosyle, or Microsoft Intune, call your IT Help Desk with your Mac's serial number so they can read you the escrowed 24-character FileVault Recovery Key.

Step 3: Unlocking a FileVault APFS volume manually from Terminal (diskutil apfs unlockVolume) .¶

If the graphical Recovery Assistant fails to mount your drive, open Utilities -> Terminal inside macOS Recovery and unlock the APFS volume manually:

# 1. List all APFS containers and encrypted volumes to find the Volume Identifier (e.g., disk3s5)
diskutil apfs list

# 2. List all cryptographic users (UUIDs) authorized to unlock that APFS volume
diskutil apfs listCryptoUsers /dev/disk3s5

# 3. Unlock the APFS volume using either your user password OR your 24-character Recovery Key:
diskutil apfs unlockVolume /dev/disk3s5 -passphrase "YOUR-XXXX-XXXX-XXXX-XXXX-XXXX-KEY"

# 4. Copy critical files from '/Volumes/Macintosh HD - Data' to an external USB drive:
cp -Rv "/Volumes/Macintosh HD - Data/Users/yourusername/Documents" "/Volumes/ExternalUSB/Backup/"

--- .

Part 3: Resolving Linux LUKS (dm-crypt / . cryptsetup) encryption lockouts¶

Linux distributions (Ubuntu, Fedora, Debian, Arch Linux, Red Hat Enterprise Linux, Pop._OS, and Qubes OS) rely on LUKS (Linux Unified Key Setup), typically LUKS2, managed by cryptsetup na dm-crypt. When a Linux machine drops into an (initramfs) anaasɛ dracut shell saying cryptsetup failed, bad password or options, follow these four steps:

Step 1: Check console keymap vs graphical keyboard layout¶

During the pre-boot initramfs phase, the system uses the Linux console keymap (/etc/vconsole.conf), which often defaults to us even if you configured a UK, German, French, or custom programmer layout inside GNOME or KDE. Boot a Linux Live USB, open a graphical terminal where you can type your passphrase visibly in a text editor to verify every character, and unlock the drive from the Live USB:

lsblk -f
sudo cryptsetup luksOpen /dev/nvme0n1p3 my_encrypted_root

Step 2: Inspect the LUKS header and check secondary keyslots (cryptsetup luksDump) .¶

LUKS1 supports 8 independent Keyslots (0 to 7) and LUKS2 supports up to 32 Keyslots (0 to 31), plus hardware Tokens (systemd-tpm2 anaasɛ systemd-fido2). Inspect your header without changing anything on disk:

sudo cryptsetup luksDump /dev/nvme0n1p3

sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 /dev/nvme0n1p3

Anamɔn 3: Woresan afi LUKS2 ti a asɛe anaasɛ wɔakyerɛw so¶

In LUKS, all keyslots live in the first 2 megabytes (LUKS1) or 16 megabytes (LUKS2) of the partition. If cryptsetup luksDump says not a valid LUKS device, take these steps:

1. Image the first 32 MB before touching anything:

   sudo dd if=/dev/nvme0n1p3 of=~/damaged_luks_first32mb.img bs=1M count=32 status=progress
   

2. Attempt automatic LUKS2 secondary JSON metadata repair (cryptsetup repair):
3. LUKS2 stores two redundant copies of the binary and JSON header metadata at offset 0x0000 and offset 0x4000 (16 KB). If only the primary copy at byte 0 was clobbered, sudo cryptsetup repair /dev/nvme0n1p3 reconstructs it from 0x4000.
4. Restore from a saved LUKS Header Backup (luksHeaderRestore):
5. Unlock non-destructively using an external header backup file:

   sudo cryptsetup luksOpen --header /path/to/luks-header.bak /dev/nvme0n1p3 rescued_volume
   

Step 4: Testing partially remembered passphrases with hashcat¶

While you cannot brute-force a random 48-digit BitLocker Recovery Key or 24-character Apple Recovery Key (\(2^{128}\) bits of entropy), you can test variations of a human-chosen LUKS passphrase or BitLocker custom user password if you remember the base words:

# For Linux LUKS2 (mode 29500) or LUKS1 (mode 14600):
sudo dd if=/dev/nvme0n1p3 of=luks_header.bin bs=1M count=16
hashcat -m 29500 luks_header.bin my_candidate_words.txt -r /usr/share/hashcat/rules/best64.rule

# For BitLocker protected by a custom User Password (mode 22100):
bitlocker2john -i /dev/nvme0n1p3 | grep "\$bitlocker\$0\$" > user_pass.hash
hashcat -m 22100 user_pass.hash my_candidate_words.txt -r /usr/share/hashcat/rules/best64.rule

--- .

Prevention: How to build a lockout-proof disk encryption backup right now¶

The moment you regain access to your computer (or on every other computer you own today), spend five minutes executing these commands so a motherboard failure or firmware update can never trap your files again:

1. On Windows (Export your BitLocker Recovery Key & pause before BIOS updates)¶

Open an Administrator PowerShell or Command Prompt and export your current 48-digit recovery password:

# Display all BitLocker recovery keys and Key IDs across all drives
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, -ExpandProperty KeyProtector |
  Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } |
  Select-Object MountPoint, KeyProtectorId, RecoveryPassword

2. On macOS (Verify or rotate your FileVault Recovery Key)¶

Open Terminal and check who is authorized to unlock your APFS startup disk:

sudo fdesetup status
diskutil apfs listCryptoUsers /

sudo fdesetup changerecovery -personal

3. On Linux (Back up your LUKS header and enroll a fallback Keyslot)¶

Always keep a copy of your 16-megabyte LUKS header on an external USB thumb drive and enroll a printed 64-character recovery passphrase into Keyslot 1:

# 1. Back up the binary LUKS header to an external USB drive
sudo cryptsetup luksHeaderBackup /dev/nvme0n1p3 --header-backup-file /media/usb/luks-header-nvme0n1p3.bak

# 2. Add an independent emergency recovery passphrase into Keyslot 1
sudo cryptsetup luksAddKey --key-slot 1 /dev/nvme0n1p3

Encryption emergency readiness checklist¶

• Export your 48-digit BitLocker Recovery Key (including its 8-character Key ID) and store it inside your password manager and printed on paper inside a fireproof safe at least 1.5 meters (5 feet) above floor level.
• Print or save your 24-character macOS FileVault Recovery Key alongside your Apple Account 28-character recovery key.
• Back up your 16-megabyte Linux LUKS header (cryptsetup luksHeaderBackup) to an offline USB drive so an accidental partition overwrite cannot destroy all keyslots.
• Maintain an independent, automated 3-2-1 computer backup so that even a catastrophic SSD controller death or forgotten encryption key never destroys your irreplaceable photos, tax documents, or source code.

--- .

Nsɛm a wɔtaa bisa¶

--- .

Akwankyerɛ ahorow a ɛfa ho¶

• Windows Blue Screen (BSOD) ne boot asiesie
• macOS kernel panic, black screen, and recovery
• Linux nhyehyɛe boot huammɔdi ne GRUB asiesie
• Password manager lockout ne ntɛmpɛ vault a wɔsan nya
• Hard drive a entumi nyɛ adwuma yiye ne data a wɔsan nya
• Computer backups: 3-2-1 strategy and disaster recovery
• Emergency nɔma ahorow ho kyerɛwtohɔ

--- .

Sources a wɔhwɛɛ mu¶

• National Institute of Standards and Technology (NIST) (United States): NIST Special Publication 800-111: Guide to Storage Encryption Technologies for End User Devices & FIPS 197 (AES-XTS).
• Microsoft Learn Official Documentation: BitLocker Recovery Overview, TPM Platform Configuration Registers (PCR 0-11) Validation Profile, and manage-bde Command-Line Reference.
• Apple Platform Ahobanbɔ Akwankyerɛ: Volume Encryption a FileVault, APFS Key Bags, Secure Enclave Hardware Root of Trust, ne Asoɛe/Ankorankoro Recovery Key Escrow. -Trusted Computing Group (TCG) (Amanaman Ntam): TPM 2.0 Nhomakorabea Nkyerɛkyerɛmu ne PC Client Platform Firmware Profile Nkyerɛkyerɛmu.
• GitLab Cryptsetup / LUKS2 Ɔmanfoɔ Nkyerɛkyerɛmu: *LUKS2 On-Disk Format Nkyerɛkyerɛmu, Argon2id PBKDF Memory-Hard Keyslots, ne Header Backup/Repair Procedures *.