7

I'm trying to decrypt my disk and turn off FileVault, but I can't do that. Firstly, the Turn Off FileVault... button is disabled.

Locked Security & Privacy FileVault Window in System Preferences - Locked

Unlocked Security & Privacy FileVault Window in System Preferences - Unlocked

Secondly, I try sudo fdesetup disable with Terminal but it also doesn't work. It returns FileVault was not disabled (-69595). Trying to Turn Off Filevault with Terminal

Edit I've also tried doing it from recovery, but it doesn't work. For more info, see the comment on @n1000 's answer.

I'm running Mac OS Mojave (Version 10.14.1) on a MacBook Air 11" (Released in Mid 2013). Thanks!

Improve this question
7
  • 2
    Do you have an SSD and a T2 chip?
    – bmike ♦
    Commented Jan 20, 2019 at 4:52
  • 2
    On the newest Macs that ship with the T2 chip that is the controller for the SSD, the drive is always encrypted. There is no turning that off so to revert to the state where you have automatic decryption and no user account authorized to decrypt, you would need to wipe the OS in an erase install scenario and the restore files and apps from your backup. - apple.stackexchange.com/questions/349028/…
    – bmike ♦
    Commented Jan 20, 2019 at 4:55
  • 2
    My Mac is an 11-inch Macbook Air released in Mid 2013 and it has a Hard Drive.
    – Maytha8
    Commented Jan 20, 2019 at 4:57
  • 2
    Ok. Let’s get that edit d into the main question. I’ll delete this since it’s not applicable. Thanks @Mth for the extra details
    – bmike ♦
    Commented Jan 20, 2019 at 5:36
  • Please explain why you want to decrypt your drive. The 2013 MacBook Air ships ONLY with an SSD. It does NOT have a T2, which only ships in 2017 and later devices. Please explain what you're trying to accomplish, and why. Do you have an encrypted EXTERNAL drive or are you trying to decrypt your internal SSD?
    – Wilfred Smith
    Commented Apr 17, 2019 at 20:11

2 Answers 2

Reset to default
2

sudo diskutil cs decryptVolume <disk> -passphrase "YOUR_RECOVERY_KEY"

If you don't have a recovery key created separately from your users passphrases, you can follow the instructions here:

https://support.apple.com/en-us/HT202385

Usage:  diskutil coreStorage decryptVolume
        lvUUID|MountPoint|DiskIdentifier|DeviceNode
        [-stdinpassphrase | -passphrase passphrase]
Start a background decryption process that will convert the on-disk bytes which
back the given logical volume from encrypted back to plain. You must supply a
"Disk" passphrase (not a FileVault User passphrase) interactively or with one
of the above parameters. After this command completes, the conversion will be
ongoing; you can check progress with `diskutil coreStorage list`.
Example: diskutil coreStorage decryptVolume
                  11111111-2222-3333-4444-555555555555
Improve this answer
3
  • Trying that results in -passphrase does not appear to be a valid Core Storage Logical Volume UUID or disk
    – Maytha8
    Commented Jun 16, 2019 at 10:33
  • You need to add the disk identifier, mount point or similar in there as well.
    – jksoegaard
    Commented Jun 16, 2019 at 12:13
  • Now, it results in /Volumes/Macintosh HD does not appear to be a valid Core Storage Logical Volume UUID or disk
    – Maytha8
    Commented Sep 27, 2019 at 10:53
0

Apple’s support procedure for this will likely be make a backup, wipe the partition that isn’t behaving and throws the error and make your Macintosh HD anew. Then it won’t be stuck and you should be able to enable and disable the encryption in a forward and reverse direction.

Barring that, Here is one process to try in case the file system needs minor repair while the OS isn’t running:

  1. Boot into recovery mode by pressing cmd+R at starup.
  2. Open Disk Utility and unlock your partition. You can either use an enabled account password or the recovery key.
  3. Select the drive and press "First Aid"
  4. Select the partition and press "First Aid"
  5. Close Disk Utility and select "Terminal" from "Utilities" in the menubar
  6. Try sudo fdesetup disable again

Another potential avenue for failure is if your secure token / APFS setup is messed up. Here’s a very detailed admin procedure that works to reset FileVault when you can’t enable things. It might also apply when you can’t decrypt.

I would encourage you make a full backup before resetting the FileVault password since if that fails, you could be locked out to even read the data at next reboot.

Some notes:

  1. Really check your backup is current and you have time to restore from it after an OS reinstall.
  2. You will need to use the terminal from recovery OS to run resetFileVaultpassword
  3. You will have to reset all the passwords on the computer. That means re-entering them. The system counts putting the same password in place, but you will have to type them out and if you mis-type or don’t record them and the FileVault key - you could get locked out. If this fails, chances are pretty hight that something is broken in your partition and you can still reformat the drive completely and restore your data.
Improve this answer
3
  • Not sure why -2, but I gave it a +1 and added some specific reasons why this might work instead of an erase.
    – bmike ♦
    Commented Jun 16, 2019 at 13:18
  • I also added the resetFileVaultpassword option to ensure the secure token is in place and harmonious with the FileVault keys to unlock from user account passwords. Feel free to revert my edits if you would rather I put that answer separate.
    – bmike ♦
    Commented Jun 16, 2019 at 13:25
  • Thanks @bmike for the good edits. I would really appreciate feedback when downvoting.
    – n1000
    Commented Jun 17, 2019 at 9:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .