FileVault 2 and Recovery HD
Recovery HD not to be confused with the Recovery OS (one is greater than the other).
When you enable FileVault 2 for a user: the non-encrypted hidden Apple_Boot Recovery HD partition, separate from but critical to the encrypted startup volume, is temporarily mounted for writes to EFI-related and other files. If you wish to view this file system activity, whilst enabling a user for unlock purposes:
- before clicking Done, use a command such as fs_usage or an application such as fseventer.
A glance at the activity suggests that edits to the non-encrypted volume — in relation to the user account on the encrypted volume — are nontrivial.
If a user is given inappropriate authority to unlock
Maybe an update to Lion (something greater than Build 11A511) will provide a way to remove, from the EFI loginwindow, a user who should no longer be able to unlock the startup volume.
In the meantime I can think of only two methods that may be used.
Method A: disable then enable FileVault
disable FileVault 2
allow backward conversion to complete
restart the operating system
enable FileVault 2, but not for that user.
Method B: remove the user but not the home directory, et cetera
I have not tested this method, I imagine that the following might work:
backup
remove the user but not the user's home directory
restart the operating system
create a new user with the same RecordName as the original
set a UniqueID number that differs from the original
associate the previous home directory with the new user.