Actually I asked after some success because I thought it would benefit everyone ;-)
Here is the complete process. Some links are missing because I don't have enough reputation to embed them all. Sorry about that.
High-level, we "just" need dislocker.
But to install it, there are some dependencies to resolve... we need:
- "Fuse for OS X"
- Simply download the .img on their site, open and run the .pkg installer
Xcode command-line developers tools
Following instruction on their website, type following in terminal:
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
If you get an error about Xcode tools not being installed whereas you did install it, then change the path to Xcode:
sudo xcode-select -switch /
and obviously dislocker !
Don't be desperate, it's now time to mount the USB stick !
But it's not gonna be trivial...
- Identify the device of the USB stick, using Disk Utility:
- Open Disk Utility and select the USB stick drive. Somewhere you should get something like "disk3s1". Replace this example with your actual value in following lines.
- Keep Disk Utility open, it will be used in next steps
- Eject the USB drive for example from Disk Utility (Unmount button)
Create a directory for the decrypted file
sudo mkdir /tmp/mydrive
Warning: this directory will have strange characteristics: it appears with "ls" but not with "ls -l" and not in the Finder wherever it is, moreover the content can't be listed, and trying to delete it often fails with strange error messages. That's why I put it in /tmp which is cleaned at every reboot.
Decrypt the USB stick with dislocker. If disk is "disk3s1" and the password is "MyPassword", the command will look like:
sudo dislocker-file -V /dev/disk3s1 -v -uMyPassword -r -- /tmp/mydrive
Add the disk image to Disk Utility and mount it
sudo hdiutil attach -imagekey diskimage-class=CRawDiskImage /tmp/mydrive/dislocker-file
Note: Don't try to list "/tmp/mydrive/dislocker-file" by yourself. Just assume it is there and write the path as is.
Hourray !!!, the new drive is there !
Because really nothing is easy, to clean-up you need to do the following:
- Unmount the drive
- For example from your friend Disk Utility, select its icon and click on "Unmount" button
- Get rid of the image
- From "Disk Utility", select the greyed drive, and from the menu "File" select "Eject".
Detach the fuse volume
sudo hdiutil detach /tmp/mydrive/
Only now the directory /tmp/mydrive is a plain directory that can be deleted...
As you noticed the process is definitely complex and finally I just get a read-only drive.
I'm interested by any better answer.