FileVault 2 encrypted drive not accepting unlock password in recovery mode

Question

My Mid-2012 Mac Book Air running an up-to-date install of Mountain Lion crashed the other evening (browsing the web, one tab started beach-balling, and refused to be force-quit so I forced a restart).

When restarting, it seems to accept my user's password to unlock the FileVault 2 encryption (I'm certain the password is correct, and typing a known incorrect password results in a shaky input field). The next screen is a grey screen, with a spinning progress wheel. Eventually a grey embossed sign is displayed, and that's about as far as it progresses. Booting using verbose mode (⌘+V) results in repeated lines of Still waiting for root device being logged.

Entering recovery mode (⌘+R) to try and restore from a TimeMachine backup, or zap the drive and re-install from the internet gets me as far as a password input box requesting I "Enter a password to unlock the disk Macintosh HD", but I cannot get past this screen despite entering correct passwords for both users who have the ability to unencrypt the drive (And I think getting past the initial unlock screen with these passwords demonstrates that they work, but I'm happy to be corrected), with the password box just shaking and rejecting the password.

Attempting to unlock the drive from the Terminal in Recovery Mode fails to mount the drive, but claims to have been unable to unencrypt it:

-bash-3.2# diskutil cs unlockVolume XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
Passphrase:
Started CoreStorage operation
Logical Volume successfully unlocked
Logical Volume successfully attached as disk13
Error: -69842: Couldn't mount disk

I've run the hardware tests, and they showed no problems. I've seen this question describing similar symptoms, but that solution did not appear to help, with the password field of the Unlock Drive menu option in Recovery Mode's Disk Utility also rejecting the password.

Essentially my question is "how can I get my laptop back into a working state"? I have recent TimeMachine backups, and so if the least painful is to format the drive and start again then I'm happy to do that, but at present I can't manage to get the drive wiped.

I have my FileVault Encryption key if necessary.

Answer 1

Just had this happen to me, error -69842 on a FileVault encrypted mid-2013 MacBook Air, and I spent a fair bit of time on it the last few days. I tried Recovery Mode, Target Disk Mode, fsck_hfs, and DiskWarrior with no luck. Disk Utility gave me an error 'Invalid thread record' or something like that. DiskWarrior indicated it was a 'disk hardware failure'. It was a corrupted FileVault volume no doubt.

I was finally able to get at my files by booting up in single-user mode. Hold CommandS while booting. You'll have to pick a user and enter your password, then it'll drop you to command line. The encrypted volume that would otherwise fail to mount with Disk Utility or 'diskutil coreStorage unlockVolume' will be already mounted in your Unix shell. Apparently single-user mode bypasses whatever filesystem check is failing when an error unlocking occurs. Perhaps this is because no fsck is being run, I'm not sure.

I was able to get my files off this way using a connected USB drive. Run mount -uw / && mkdir /Volumes/usb, then plug the USB in and do ls /dev/disk* to find the name. Mine was /dev/disk2s2, so mount_hfs /dev/disk2s2 /Volumes/usb and I had a way to copy files off. Use mount_msdos instead of mount_hfs if you formatted it for non-Mac use. I selectively copied user folders one thumbstick at a time, but if you have a large enough USB drive attached then just do a tar czpf /Volumes/usb/Users-backup.tgz /Users to get a copy of the entire /Users folder in tar-gzip format.

Recreating the FileVault volume is necessary. I did not find a way to repair it.

Answer 2

To just delete the bad volume and start over type:

diskutil cs deleteVolume XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

At that point the normal diskutil and Disk Utility steps will allow partitioning or just run the installer since your drive will effectively be empty (filled with random encrypted bits with the cs keys and file system structure effectively shredded)

This is a feature where you can cryptographically erase a drive by throwing away the container that allows the key to decrypt the data. A secure erase and install process not explicitly detailed by Apple but implied.

• https://support.apple.com/en-us/HT204904
• https://support.apple.com/en-us/HT208496

Answer 3

Here's what I did. Found it on reddit today. Thank god, I was about to buy some data recovery software. Hope it helps.

https://blog.kylekukshtel.com/big-sur-update-failing-diskutil-apfs-filevault-sync-users

Edit: Here is the tl;dr from that blog

Delete the Update and Macintosh HD (NOT Macintosh HD - Data). I was then able to access my data drive from an external drive with catalina.