I got a used MacBook Air 11 (2014) and the first thing I did was wiping the whole drive and re-adding partitions.
OS X extended journaled encrypted which should be the same as File Vault 2
After reinstalling the OS (Mavericks) I've updated all the way to macOS Sierra 10.12.3 and added a second user non-admin user account.
Now the confusing part:
When cold starting my MacBook it would go straight to the login screen without asking for the disk password (how would that happen if it's supposed to be full disk encrypted ? I'm not talking about hibernation, I've properly shut down my MacBook)
The login screen would show the
non-admin accountand a
Disk Passwordoption, both work as expected, but it wouldn't show my admin account
a) After entering the Disk Password the
admin accountwould show up
b) If I decide to NOT enter the Disk Password, I can still log into the
non-admin account. More over, if I then log out, my
admin accountwould mysteriously appear and I can log into it without ever using the my disk password.
I used the
diskutil cs list command and it shows that my Logical Volume is properly wrapped in a AES-XTS encrypted Logical Volume Family
Now the question here is, is this really working ? According to some official (maybe outdated) Apple website it should ask for the disk password on boot up, before the login screen.
sudo gpt -r show disk0:
start size index contents 0 1 PMBR 1 1 Pri GPT header 2 32 Pri GPT table 34 6 40 409600 1 GPT part - XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX 409640 235298960 2 GPT part - XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX 235708600 1269536 3 GPT part - XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX 236978136 7 236978143 32 Sec GPT table 236978175 1 Sec GPT header