Okay, so I have three main volumes for my system; one for the OS (SSD) one for users and files (Fusion Drive) and one for backup.

All three are encrypted Core Storage volumes.

The problem is that only the OS volume is unlocked on startup, the other two won't be unlocked until a user logs in. That's fine except that only my system's administrator user is on the OS volume, all the others are on the users and files volume, so they can't login until that volume has been unlocked.

Currently this means that on start-up I need to login as the administrator so that the drives unlock, and then logout and login as the correct user which is is kind of annoying, as really I don't want to login as the administrator at all as it's only there for permissions or recovery).

The two non-OS volumes have their keys stored in the system keychain, with CSUserAgent permitted access, however the name of this tool suggests it won't run until a user logs in.

What I'm wondering is whether there's a way to trigger an unlock sooner without having to do something insecure (like put the password into a script)? Since the passwords are in the system keychain, I thought perhaps I could just permit access to the appropriate process, or even that a script run as root (i.e - a LaunchDaemon with RunAtLoad) might be able to unlock the volume(s)?


1 Answer 1


Here is a script that automatically unlocks: https://github.com/jridgewell/Unlock

Unlock allows the system to unlock and mount Core Storage encrypted volumes during boot. In other words, this allows you to log in as a user whose home directory is on an encrypted secondary disk without any problems.

Install Lock

Run this in the terminal.

curl -L https://raw.github.com/jridgewell/Unlock/master/install.sh | bash
  • You will be asked for your login password.
  • Follow the prompts
    • The install script will find all Core Storage encrypted volumes connected to your computer (it will ignore the startup volume).
    • It will then loop through the volumes it finds and ask you if you want to unlock the volume during boot.
    • If you do, it will then ask for the passphrase used to unlock that volume.
  • Everything should be set up! Restart your computer and log in to test.

Uninstall Lock

Run this in the terminal (you'll be asked for your login password) to remove all traces from the system.

curl -L https://raw.github.com/jridgewell/Unlock/master/uninstall.sh | bash
  • It would be useful to post the contents of the link here, as otherwise if the link vanishes, the usefulness of this answer does too
    – Tetsujin
    Nov 5, 2014 at 12:03
  • Thanks for the response! The script has some useful pieces within it, but it looks like the important part is actually just setting unlock as an allowed app in the keychain entry. I wonder if the same thing could be achieved simply by allowing diskutil to access the password entry, and then call it with the -recoverykeychain option pointing to the system keychain? Seems like that might be all unlock really does, albeit with some automated setup.
    – Haravikk
    Nov 6, 2014 at 10:46

Not the answer you're looking for? Browse other questions tagged .