0

I have an external disk with partitions A and B. B is an encrypted HFS volume with as password. (Presented as "Apple_CoreStorage" or "Logical Volume OS X Extended").

When I connect the drive, OS X asks for the password to the partition. If I unmount the partition, and mount it again, OS X does not ask for the password.

I have to physically disconnect the drive and connect it again to make OS X ask for the password.

Is there any way to require the password to be entered every single time the partition is mounted? (This is the way encrypted sparse images work, for example.)

1

This is a flaw in the CoreStorage encryption system. When you first connect the physical disk, the volume is in state Locked. Once you enter the password, the volume becomes Unlocked. (you can actually see the state of your volume from diskutil list)

The problem is that CoreStorage does not lock a volume until it is physically removed from the system.

My theory is that the keys used to unlock the volume being stored within memory until the drive is ejected - although the volume may be unmounted and locked, the keys to unlock it remain within memory. Attempting to remount and unlock the partition just calls for the keys from memory instead of asking for the password.

1

You should be able to reliably lock the disk (in fact these are two disks: one physical and one logical) by first ejecting the unlocked, encrypted volume and then ejecting the base disk containing the Logical Volume Group:

Usually a mounted and unlocked diskutil listing looks like this:

/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *68.7 GB    disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:                  Apple_HFS Macintosh HD                 67.9 GB    disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
/dev/disk1 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *68.7 GB    disk1
   1:                        EFI EFI                     209.7 MB   disk1s1
   2:          Apple_CoreStorage Encrypted               68.4 GB    disk1s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk1s3
/dev/disk2 (internal, virtual):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Encrypted              +68.0 GB    disk2
                                 Logical Volume on disk1s2
                                 AFD60A02-82C4-46B8-B354-6D37E1AEB9CE
                                 Unlocked Encrypted

Disk0 is my system disk containing an unencrypted system volume on disk0s2. Disk2 is a logical disk representing the encrypted volume. Disk1s2 contains all Core Storage items representing a FileVault2 encrypted volume. Parts of the Core Storage items (the Logical Volume Family and the Logical Volume) are the "logical" disk2.

If you first eject disk2 and then disk1 by entering

diskutil eject disk2
diskutil eject disk1

in Terminal.app the Logical Volume should be locked afterwards. This usually won't detach the disk physically (i.e. it's still visible in diskutil list). If you want to remount the disk afterwards simply enter:

diskutil mountDisk disk1
diskutil cs unlock lvUUID -passphrase passphrase
diskutil mount disk2

If your external disk is not self-powered or a thumb drive you may have to unload and reload a kext first:

kextunload /System/Library/Extensions/IOUSBMassStorageClass.kext

followed by:

kextload /System/Library/Extensions/IOUSBMassStorageClass.kext

to make the disk visible again in diskutil list.


If you have one internal disk and one external encrypted drive only this is scriptable with ease. You may either create bash script(s) or an Apple Script/Automator service.

If you have several external disks attached at the same time you have to detect and filter the various UUIDs and disk identifiers first.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .