Let's see if we can find out what may have happened.
If the drive was previously formatted as APFS (non-encrypted) and has now mysteriously changed to APFS (Encrypted) without you knowingly initiating it, then something triggered a reformat or a conversion at the file system level.
AFAIK, the most common scenarios for this include:
- FileVault-style encryption prompted or applied unintentionally, possibly during a macOS update or a migration process. Although FileVault itself targets internal disks, external APFS volumes can be encrypted via Finder or Disk Utility prompts that resemble permissions alerts.
- Access via another user account or device (yours or someone else’s) may have inadvertently prompted encryption—sometimes even just clicking the “Encrypt” option from the Finder context menu can do it.
- A macOS system bug or miscommunication between iCloud Keychain and Disk Utility could have stored a password silently and encrypted the volume behind the scenes. There have been scattered reports in Sequoia and late Sonoma builds of system-side changes affecting APFS volumes after reconnecting them post-update.
In all or these situations, macOS will prompt for the password used at the time of encryption, not your admin password unless you were logged in and initiated it.
Now that you know potentially why, and before going down the data recovery rabbit hole, what can you do about it?
I suggest starting with trying common passwords or your iCloud password. Those would be:
- Your Mac's user account password.
- Your Apple Account password.
- If you’re using iCloud Keychain, open Keychain Access and search for the volume name; there’s a chance the encryption password is stored there.
Next, check for saved passwords in iCloud Keychain:
- Open System Settings > Passwords (or Safari > Preferences > Passwords), authenticate, and search for the drive name.
- Also, open Keychain Access, check both login and iCloud keychains, and search for anything resembling your external drive.
Next, let's try to find out what type of encryption this drive has. We will do this using the following command in the Terminal: diskutil apfs list
Look for the volume’s encryption status, its UUID, and whether it has a "locked" state. This gives you clues about what kind of encryption was applied (e.g., FileVault-style or native APFS encryption).
Should you be successful to gain access via a password at this time, I strongly suggest that you immediately clone this drive, using something like Carbon Copy Cloner, SuperDuper!, or the dd command in the Terminal to another 4TB drive. That buys you peace of mind before experimenting further.
Lastly, if you can’t get in and nothing is working, data recovery companies (DriveSavers, Ontrack, etc.) can often brute-force password-protected APFS drives if the encryption was shallow or poorly applied. But this gets expensive quickly, and success isn’t guaranteed.
Could You Have Screwed Up the Password Chain? Yes, but not intentionally. If you clicked something or confirmed a Finder popup (especially during or after an OS upgrade), the system may have interpreted it as permission to encrypt the drive — often without clear feedback.