If you use FV2 to encrypt a disk, can the root user of the computer access the unencrypted contents of the disk or is it truly only accessible by the user that initially setup FV2.

We are trying to deploy FV2 across our company and trying to see if we should set a Firmware Password to restrict access to boot commands or if FV2 will be sufficient.

  • If you intend to deploy FV on a large scale, take care to collect the recovery keys of any FV partition. Check them, put them in a safe. – dan Dec 13 '14 at 23:32

Once you've logged in using one of the users set up for FV2, the unencrypted data is available to all users on the computer. All of them: root, admins, regular users, and non-login users like _www or _spotlight.

If you make the disk available to another computer, either by physically moving it or using target disk mode, then no one on the other computer, not even root, can access the data.

  • Ah ok, so the drive ONLY decrypts when the user who enabled it logs in. I am assuming that is until you reboot the computer. – ProfFrnswrth Dec 10 '14 at 3:00
  • More precisely, it's until you unmount the disk volume. Restart (or Shut Down) unmounts all volumes. – ganbustein Dec 10 '14 at 19:39
  • The FV encrypted partition is available to all, until… the end of the legitimate user session. At this logout, the FV partition is unmounted and hence protected. I'd suggest to improve your answer with this point. – dan Dec 20 '14 at 10:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .