Open an encrypted USB stick with digital case files on Mac

Who is this page for?

This page is written for lawyers, defence counsel, victims’ counsel and staff at law firms who are handed a digital case on a USB stick encrypted with Windows BitLocker and who work on a Mac. It can also serve as a starting point for the firm’s IT or data protection officer, who has to decide whether a new tool may be used.

Unbit is a small macOS app for opening BitLocker-encrypted external drives. It was not built specifically for the justice system, and Unbit has no agreement with the police, the prosecution service or the courts.

The problem: a BitLocker stick can’t be opened on a Mac

According to the Danish Courts’ guidance (in Danish, version 2.0), the prosecution service sends digital court cases to the court, defence counsel and any victims’ counsel on a USB stick encrypted with Windows BitLocker. The password is sent separately by secure email. On a Windows PC, BitLocker asks for the password automatically when the stick is inserted. macOS, however, can’t open BitLocker-encrypted drives on its own.

When the stick is inserted into a Mac, macOS typically only offers to ignore, eject or initialise the drive. Never choose Initialise – it erases the drive.

For Mac, the guidance mentions the third-party program “M3 Mac Bitlocker Loader”. It describes no approval procedure for programs and does not say that other programs may freely be used instead. We have not found a public rule that a particular program must be approved by the police either. The guidance is, however, older, and we can’t say what an individual prosecution office expects. See the sources at the bottom of the page.

How Unbit helps

Unbit unlocks a BitLocker-encrypted external drive with a password or 48-digit recovery key and opens it in Finder. That is what the app does – nothing more.

• Opens the stick read-only. Unbit does not write to the stick. The drive appears in Finder as a read-only drive, and the app only reads.
• No macFUSE and no drivers. You don’t install macFUSE, dislocker or similar. Unbit is an ordinary Mac app, signed with a Developer ID and notarised by Apple. An optional one-time setup does install a small, restricted read helper, which requires an administrator password – see the security note.
• Everything happens on your Mac. Decryption runs locally in the app. Files, codes and drive details are not sent to a cloud service or to Unbit. The decrypted drive is handed to macOS over a local connection on the Mac itself (127.0.0.1), and no decrypted copy is written to disk.
• The code stays on the Mac. The password or recovery key is entered in the app and not sent anywhere. If you choose “Remember this drive on this Mac”, the code is saved only after a successful unlock, and only in your local macOS keychain (not synced via iCloud). The option is off by default.
• No analysis of the drive’s contents. The app has no analytics or telemetry. The only network traffic we know of in the app is the automatic update check (Sparkle) once a day via GitHub; it does not include the drive’s contents, file names or codes.

Limitations: Unbit supports external drives only (not internal disks), requires macOS 13 or later, and opens drives protected with a password or a 48-digit recovery key. Unbit is not a forensic tool and does not produce logs or checksums of the stick’s contents. BitLocker sticks can’t be opened on an iPad, with Unbit or any other tool.

Step by step

1. Read the terms and instructions that came with the case from the prosecution, the police or the court, and check that you may use a program like Unbit. The password usually arrives separately by secure email.
2. Download Unbit, move the app to Applications, and open it from there. It lives in the menu bar.
3. First time only: choose Set Up Read Access… in Unbit and approve with your Mac password. This one-time setup installs a small read helper. If you skip it, Unbit asks for administrator approval every time a drive is opened.
4. Insert the USB stick and select its partition in Unbit. If macOS offers to initialise the drive, don’t.
5. Choose Password and enter the code from the prosecution. If you have a 48-digit recovery key instead, use the Recovery Key tab.
6. Leave “Remember this drive on this Mac” off unless your firm has decided that codes may be stored in the keychain.
7. Click Open Drive and approve with your Mac password if asked. The stick opens in Finder, read-only.
8. Work with the material under the terms you were given. Note that files copied from the stick to another location are no longer encrypted by BitLocker.
9. Click Eject Safely when you are done, and only then remove the stick. Handle and return the stick as the terms require.

More detail and troubleshooting: How to open a BitLocker drive on Mac and BitLocker USB drives on Mac.

Security considerations for the law firm

Advokatsamfundet’s article on its GDPR guidance for lawyers (May 2025, in Danish) stresses that personal data must be processed securely and that the law firm itself decides how risks are assessed and which security level is appropriate. Responsibility for secure handling therefore rests with the firm. The points below are suggestions for what the firm may consider – not an exhaustive or approved list.

• Data protection and local processing. Unbit processes the contents locally on the Mac, and the contents are not transferred to Unbit or a cloud service. What that means for your data protection assessment (for example regarding data processor agreements) is for you to decide.
• Protect the Mac itself. Turn on FileVault, use a screen lock with a short timeout, keep macOS up to date, and avoid shared user accounts. While the stick is open, anyone using the Mac can read its contents.
• Copies are no longer encrypted. The Danish Courts’ guidance warns that files transferred from the stick to another medium, drive or email are no longer encrypted. Decide whether material may be copied out and, if so, where the copies may be kept. macOS may also leave traces outside the stick, such as thumbnails, Quick Look caches, recent documents, search indexes and backups – assess whether that is relevant to your setup.
• Decide on keychain storage. By default no codes are saved. If you save a code, anyone with access to your macOS user account can open that stick. Consider not doing so on shared or laptop Macs, and use Forget Code in the gear menu once the stick is no longer needed.
• The read helper. The one-time setup installs a root launchd service on the Mac that can only open external disks read-only. If the firm doesn’t want it, skip the setup and approve with an administrator password each time. The helper can be removed with Remove Read Helper…. On managed Macs, IT may need to perform the setup.
• Eject safely and handle the stick properly. Use Eject Safely before removing the stick, and follow the terms for keeping, deleting or returning it.
• Source and updates. Download the app only from unbit.app or Unbit’s GitHub releases, and verify the signature (see the security note). The app checks for updates itself and verifies them with a digital signature. Revisit your assessment for major new versions.

How to assess whether the tool is suitable

Use these points as a starting point for the firm’s own risk assessment. This is not an approval procedure, and ticking every box is no guarantee that the use is acceptable.

• Terms: Have we read the terms and instructions the prosecution, police or court provided, and do they not rule out programs other than those mentioned?
• Risk assessment: Have we assessed the risk of the processing and chosen an appropriate security level in line with the firm’s data protection policy – and does that assessment cover Unbit?
• IT review: Has IT read the security note below and accepted the permissions the app asks for (administrator access, possibly Full Disk Access, possibly the keychain)?
• Not officially approved: Do we understand that Unbit is not approved, certified or recommended by the police, courts or Advokatsamfundet, and is that stated in our assessment?
• The Mac: Is FileVault on, is the screen lock set up, is macOS up to date, and is the Mac not used by others?
• Codes: Have we decided whether passwords and recovery keys may be saved in the keychain (default: no)?
• Copies: Have we decided whether material may be copied out of the stick, and where copies may be kept and deleted?
• Source: Do we download the app from unbit.app or the GitHub releases, and have we checked Apple’s notarisation and the developer signature?
• Testing: Have we tried the procedure on a non-confidential BitLocker test drive before opening a real case stick?
• Responsibility and documentation: Have we decided who is responsible, where the assessment is documented, and when it is reviewed?

Written clarification. If in doubt, the firm can ask the issuing prosecution office for written clarification on whether using a particular program is acceptable. This is an option that may remove remaining uncertainty – not a documented requirement.

Security note for your IT

A short text you can copy or download and forward to your IT department or data protection officer. The note is written by Unbit – it is not an independent audit.

SECURITY NOTE – Unbit (macOS app for opening BitLocker-encrypted external drives)
Prepared by Unbit, 2 October 2026. Applies to Unbit 1.0.x. Source: https://unbit.app/en/lawyers

This note is written by the developer and is not an independent security audit. Unbit is not approved, certified or recommended by the police, the prosecution service, the courts or Advokatsamfundet. The law firm assesses whether the tool is suitable.

PURPOSE
Unbit opens BitLocker-encrypted external drives (USB sticks, SSDs, HDDs) on a Mac using a password or 48-digit recovery key. It is used, for example, for digital case files on USB sticks encrypted with Windows BitLocker.

WHAT THE APP DOES
- Reads the drive’s BitLocker metadata and decrypts the keys inside the app (its own Swift implementation).
- Decrypts data on the fly and makes it available to macOS as a read-only disk image (hdiutil attach -readonly) through a local server on 127.0.0.1 with a random address. No decrypted copy is written to disk.
- Opens the drive in Finder (read-only). “Eject Safely” unmounts and ejects the drive.

WHAT THE APP DOES NOT DO
- It does not write to the drive (the device is opened read-only).
- It does not install macFUSE, dislocker, kernel extensions or other drivers.
- It does not send the drive’s contents, file names, passwords or recovery keys to anyone, uses no cloud service and has no analytics or telemetry.
- It does not support internal disks and is not a forensic tool (no checksums or logs of the contents).

PERMISSIONS AND CHANGES TO THE MAC
- Administrator password: “Set Up Read Access” (one-time setup) installs a restricted launchd service running as root under /Library/LaunchDaemons and /Library/PrivilegedHelperTools (named after Unbit’s app ID). The service only accepts connections from the console user and from the exact installed, signed app. It opens only external, physical partitions read-only and hands the app a file descriptor. It never receives passwords. It can be removed with “Remove Read Helper…” in the app. Without the setup, administrator approval is required each time a drive is opened.
- Full Disk Access: macOS may require it for direct reads of the drive. It is also required for the optional “Open known drives automatically” and “Notify when a drive is connected” features (both off by default).
- Keychain: only if the user chooses “Remember this drive on this Mac” (off by default). The code is saved after a successful unlock as an ordinary password item in the user’s local keychain (not synced) and can be deleted with “Forget Code”.
- Notifications (optional; macOS asks) and Start at Login (off by default).
- Clipboard: read only when the user clicks “Paste Recovery Key”.
- The app does not run in the App Sandbox (needed for direct reads of the drive), uses the hardened runtime, is signed with a Developer ID and is notarised by Apple.

NETWORK
- The only network call we know of in the app is the automatic update check via Sparkle 2, once a day (it can also be started manually). The update feed is hosted on GitHub Pages (github.io), and the update itself is downloaded from github.com (release files). Updates are verified with an EdDSA signature. Sparkle’s optional system profiling is not enabled.
- The local disk image is served only on 127.0.0.1 (loopback), with at most 16 concurrent connections and a random 128-bit token in the address.
- The website unbit.app (not the app) uses Vercel Analytics and Speed Insights for visitor statistics.

LOGGING AND ERROR REPORT
- The app does not store codes or file names in logs. Timing measurements can be seen in Console (subsystem named after Unbit’s app ID) without codes, volume IDs or file names.
- “Copy Error Report” does not contain codes, drive or volume names, paths or anything the user typed.

VERIFYING THE APP
- spctl -a -vv /Applications/Unbit.app  (expected: accepted, source=Notarized Developer ID)
- codesign -dv --verbose=2 /Applications/Unbit.app  (Team ID: 6XTQ98822R)
- Test first on a non-confidential BitLocker test drive.

REMOVAL
- Choose “Remove Read Helper…” in the app, delete the app from Applications, and delete any saved codes with “Forget Code” or in Keychain Access (items whose service name is based on Unbit’s app ID).

NOTE
This description is based on the developer’s own documentation and may change in newer versions. Using Unbit does not change the law firm’s responsibility to assess risks and security levels itself, or the terms set by the authority that supplied the material.

Sources

This page is based on the following public sources (both in Danish). Check for yourself what applies at the time you read this.

• Vejledning til retten og forsvarere om åbning af digital sag på krypteret USB-stik (Danish Courts, version 2.0, PDF). Describes that the prosecution sends digital cases on a Windows-BitLocker-encrypted USB stick with the password by secure email, mentions the program “M3 Mac Bitlocker Loader” for Mac, and warns that files transferred to another medium are no longer encrypted. It describes no approval procedure for programs.
• Sådan arbejder du med overholdelsen af GDPR som advokat (Advokatsamfundet, 23 May 2025). Discusses Advokatsamfundet’s March 2025 GDPR guidance for lawyers and stresses that the law firm should assess risks and decide which security level is appropriate.

Unbit is not affiliated with the Danish Courts, the prosecution service, the police or Advokatsamfundet, and these references do not imply their endorsement.