public T deserialize(byte[] serialized) throws SerializationException {
        if (serialized == null) {
            String msg = "argument cannot be null.";
            throw new IllegalArgumentException(msg);
        }
        ByteArrayInputStream bais = new ByteArrayInputStream(serialized);
        BufferedInputStream bis = new BufferedInputStream(bais);
        try {
            ObjectInputStream ois = new ClassResolvingObjectInputStream(bis);
            @SuppressWarnings({"unchecked"})
            T deserialized = (T) ois.readObject();
            ois.close();
            return deserialized;
        } catch (Exception e) {
            String msg = "Unable to deserialize argument byte array.";
            throw new SerializationException(msg, e);
        }
    }
This implementation deserializes the byte array using a {@link ObjectInputStream} using a source
{@link ByteArrayInputStream} constructed with the argument byte array.

@param serialized the raw data resulting from a previous {@link #serialize(Object) serialize} call.
@return the deserialized/reconstituted object based on the given byte array
@throws SerializationException if anything goes wrong using the streams.
lang/src/main/java/org/apache/shiro/lang/io/DefaultSerializer.java