Recover Files from System Disk with SIP Enabled

Recover Files from System Disk with SIP Enabled

Modern Apple operating systems (OS X El Capitan and newer) protect their system disks with System Integrity Protection , a security feature that shelters the essential parts of OS data from unwanted alterations. While it really increases system security, at the same time it severely restricts access to files on the disk, rendering file recovery impossible.

System disk with SIP enabled

You need to turn SIP off to perform file recovery from such system disk.

To disable SIP,

1	Boot your Mac computer into the macOS Recovery mode.

Simultaneously press and hold the Command and R keys during its startup.

Keyboard shortcut to boot Mac into recovery mode

2	Select Terminal in the Utilities menu

macOS Utilities

3	Type in "csrutil disable" in the Terminal and press Enter.

SIP disabled

The message that System Integrity Protection has been successfully disabled will appear.

4	Restart your Mac computer, start Restorer Ultimate, and check that SIP is disabled

System disk with SIP disabled

Recover files from this system disk is now possible.

System Integrity Protection should be enabled again when the recovery process is over.

To enable SIP,

1	Proceed with above steps 1 to 3

2	Type in "csrutil enable" in the Terminal and press Enter.

SIP enabled

The message that System Integrity Protection has been successfully enabled will appear.

3	Restart your Mac computer

Home > File Recovery > Recover Files from Existing Logical Disks > Recover Files from System Disk with SIP Enabled