Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have a MacBook (Retina, Mid 2012 if it's relevant) which I installed Mountain Lion onto, creating one user account only (an Admin account). There is a Guest User, marked for "Sharing Only". The hard drive was encrypted with FileVault 2 at the time of install, and the recovery key stored away.

For various reasons the password to my user account was disclosed (but NOT the FileVault recovery key). I changed the password on my user account before it could be used, but the old password is still known.

Is the old password still retained with respect to the FileVault partition, and might enable someone to decrypt the FileVault-encrypted drive? Put another way, are my new password and the recovery key the only way to decrypt the FileVault partition?

share|improve this question
1  
I don't know the definitive answer to your question, but similar systems (a) encrypt the volume with a master key and (b) encrypt copies of the master key with each password/phrase that is allowed to unlock that volume. When you change your password, it should remove your old-password-encrypted key and replace it with a new-password-encrypted key. Have you tried going into recovery boot, opening Disk Utility, and attempting to unlock the volume with your old password? –  zigg Apr 10 '13 at 17:58
add comment

2 Answers

You need a current working password for your filevaulted system. Anyone who has access to such can unlock the file system. The recovery key will always be the emergency key when you forget your passcode. Think of that as your key under the rug at your house. Safely store that so you can gain access in the worst case scenario. Remember if you enabled the option when you activated filevault to store ur recovery key with apple, they can access that for you if you lose it. If you are worried the FEDS are getting into your encrypted hard drive. well you might as well say bye bye.

Here is a good site to read about how it works and what it does: http://afp548.com/2012/06/05/filevault-2-the-silent-protector/

*Edit

Also read this, "When FileVault is turned on, guest users can only log in and use Safari. Guests can’t access your FileVault-encrypted disk or create files. Instead, they log in and use Safari from your computer’s built-in recovery disk." support.apple.com/kb/PH11321

Guest account boots in a different partition that does not have access to the encrypted partition

The question your asking is confusing: The password to unlock the encrypted drive is whatever your password is to login to your user account. I don't understand your problem. If you changed your user account password. Use the new user account password to unlock the system-or recovery key if necessary. Could you elaborate anymore?

share|improve this answer
    
Thanks. This doesn't really address my question, however. I understand what the recovery key is for. My question is really whether there is a separate password for the encrypted partition which is NOT my user's password or the recovery key, which by default (I could imagine) was set to be the same as the old password, and which may not have been changed when mine was compromised. –  Andrew Ferrier Apr 10 '13 at 16:03
add comment

Once you change the password, it has been charged and the old password can not access the FileVault decryption protocol. It would be nightmarish if you had to always remember any and all passwords ever used by the FileVault account(s).

If you want really great info to FileVault please watch: http://docs.macsysadmin.se/2013/video/Day2Session5.mp4

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.