Due to the nature of macOS 10.15 – 11, you cannot boot to a recovery mode with Terminal on an encrypted Apple computer.
ESET provides a workaround using the Target Disk Mode, where two Apple computers are required.
Click Computers, select the computer you want to decrypt the disk and click Show Details.
In the Encryption active dashboard, click Manage → Restore Access → Recovery data.
Type a new Password, confirm the password and click Create Recovery Data.
To download the recovery data file, click efderecovery.dat and save or copy the file to a USB disk.
On a second Apple computer, download the Encryption recovery tool for macOS and unzip and copy the
recoveryapp file to the USB disk that contains the
Open Terminal, type
cd /Volumes/[NAME], where
[NAME] is the name of the USB disk and press Enter.
Type the following command and press Enter:
Type the password you created in ESET PROTECT and press Enter.
Connect the Apple computer with the EFDE encrypted disk to a second Apple computer. Verify that the USB disk is inserted into the second Apple computer.
Boot the Apple computer with the EFDE encrypted disk to a Target Disk Mode. To do this, shut down the computer, press the power button and then press and hold the T button on the keyboard.
For example, if you are using a Thunderbolt connection, the screen of the Apple computer in Target Disk Mode will look like this:
On the second Apple computer, open Terminal, type the following command and press Enter:
diskutil apfs list
From the list of the disks, find the partition with the description FileVault: Yes (Locked). Make a note of the partition identifier (in this case, disk15s1).
Type the following command where [IDENTIFIER] is the disk identifier and [NAME] is the name of the USB disk and press Enter:
diskutil apfs unlockVolume /dev/[IDENTIFIER] -recoverykeychain /Volumes/[NAME]/FileVaultMaster.keychain
Type the password you created and click OK.
The disk will unlock and show as a mounted disk on the desktop. You can access and copy the data from the encrypted disk.
To decrypt the disk, type the following command and press Enter:
diskutil apfs decryptVolume /dev/[IDENTIFIER] –recoverykeychain /Volumes/[NAME]/FileVaultRecovery.keychain
To see the decryption progress, type the following command and press Enter:
diskutil apfs list
When the encryption is complete, you can exit the Terminal, unmount the disk (drag the disk icon to the trash bin icon), disconnect the two Apple computers and shut down and power on the Apple computer you want to decrypt to exit Target Disk Mode.