12

It's been a long saga getting to the point where I am comfortable that my new Macbook Pro has FileVault 2 enabled properly on Yosemite.

I ran into the "Encryption paused - connect power adapter" problem several times. Had to do a hard-disk erase and full re-install twice, and spent hours online with Apple support.

Eventually, encryption completed and it told me "A recovery key has been set" ... but never told me what the key was!

Today, I disabled encryption, rebooted, and re-enabled encryption - with the same result.

Eventually, I used fdesetup changerecovery --personal to create a new recovery key, which I was able to validate with fdesetup validaterecovery.

I now have that key stored in a very safe place (nowhere near my MBP).

But I originally requested, via the GUI, that the key also be stored in iCloud. Now I suspect that the key they have is not the key which will work to decrypt my drive at last resort.

I've spent hours googling, and browsing Apple's support pages, but nowhere can I find out how to update the recovery key stored in my iCloud account.

Any advice greatly appreciated

Improve this question
6
  • 1
    Just FYI, when I asked in the Apple store the answer was "what a great question!!" which implies they don't know either.
    – kdopen
    Commented Mar 6, 2015 at 23:07
  • 1
    This is a great question. I'll page the guy I know that knows more about file vault than anyone I'm aware of. I'd love an answer on how to verify that the recovery key will work and/or how to extract it so you could decrypt your drive even if the internet were down or iCloud was out of service for an extended period of time (both can and will happen).
    – bmike ♦
    Commented Apr 17, 2015 at 14:19
  • @bmike It would be interesting to ask him a command to send the manually generated recovery key also. A way to check and a way to ensure it is sent.
    – Alexandre Marcondes
    Commented Apr 17, 2015 at 20:55
  • @bmike getting any traction with your contact?
    – kdopen
    Commented Apr 21, 2015 at 14:55
  • @kdopen I believe they didn't know anything other than calling AppleCare and answering the security questions.
    – bmike ♦
    Commented Apr 21, 2015 at 15:53

3 Answers 3

Reset to default
2

According to Apple's [documentation on Filevault 2] (https://support.apple.com/en-us/HT4790) (emphasis added by me)

Changing your recovery key

In the Security & Privacy system preference, under the FileVault tab, click "Turn Off FileVault" to disable FileVault. After FileVault is off, FileVault will begin to decrypt your drive. Once decryption is complete, you can click the "Turn On FileVault" button. Doing this allows you to enable unlock-capable users. You're also provided with a new recovery key and have the option of sending this new key to Apple. The old key sent to Apple will not be able to unlock your newly-encrypted disk. If you need to retrieve your recovery key from Apple, only the new one will be retrieved based on the Serial Number and Record Number displayed in the login window.

I think that this might be your answer.

Improve this answer
2
  • 3
    My problem was (and still is) that disabling and re-enabling file-vault never shows me the new key, so I have no way of recording it somewhere safe: "Today, I disabled encryption, rebooted, and re-enabled encryption - with the same result." So I have no idea whether the cloud has the correct key, but at least I do have a secure copy of the one I manually generated
    – kdopen
    Commented Apr 17, 2015 at 13:53
  • I understand. I am trying to find it also.
    – Alexandre Marcondes
    Commented Apr 17, 2015 at 20:55
0

I don't know how to solve the iCloud issue, but I'd recommend instead that you use an excellent encryption tool like GPG or TrueCrypt (7.1a only!!) to encrypt a text file that has your FileVault Recovery Key and then you can upload that file to iCloud file storage or any Cloud service you like -- then it's super secure AND you don't have to jump through Apple verification steps or talk to support.

Improve this answer
2
  • Nice thinking. Not everyone will be comfortable with it, but for those that are, it's a nice reminder.
    – bmike ♦
    Commented May 4, 2015 at 23:16
  • Thanks. For myself, I have a premium lastpass account so having somewhere safe to store things is not a problem ... and it's completely independent of Apple
    – kdopen
    Commented Nov 2, 2015 at 23:42
0

If you choose to "Create a recovery key and do not use my icloud account" it means that the key stored in icloud can no longer decrypt your disk. Only the key you made (and wrote down, took a screenshot of, or took a picture of with your camera), will allow you to decrypt. If you chose to store the key with apple as well then you would get prompted to answer three security questions which you would need to be able to answer to decrypt your disk.

Did you get those prompts? If not, you are the sole holder of a decryption key.

Improve this answer
3
  • 1
    Note from my question: "But I originally requested, via the GUI, that the key also be stored in iCloud.". So yes, I am now the sole holder of the verified key. What I wanted was to update the one in the cloud so that it had a copy too.
    – kdopen
    Commented Jun 6, 2016 at 21:57
  • I repeat. Did you get the prompt to enter 3 security questions?
    – Tunes
    Commented Jun 6, 2016 at 23:11
  • 1
    yes, then it said "a key has been set" but it never told me what the key was
    – kdopen
    Commented Jun 6, 2016 at 23:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .