2

I got a used MacBook Air 11 (2014) and the first thing I did was wiping the whole drive and re-adding partitions.

I picked OS X extended journaled encrypted which should be the same as File Vault 2

After reinstalling the OS (Mavericks) I've updated all the way to macOS Sierra 10.12.3 and added a second user non-admin user account.

Now the confusing part:

  • When cold starting my MacBook it would go straight to the login screen without asking for the disk password (how would that happen if it's supposed to be full disk encrypted ? I'm not talking about hibernation, I've properly shut down my MacBook)

  • The login screen would show the non-admin account and a Disk Password option, both work as expected, but it wouldn't show my admin account

  • a) After entering the Disk Password the admin account would show up

  • b) If I decide to NOT enter the Disk Password, I can still log into the non-admin account. More over, if I then log out, my admin account would mysteriously appear and I can log into it without ever using the my disk password.

I used the diskutil cs list command and it shows that my Logical Volume is properly wrapped in a AES-XTS encrypted Logical Volume Family

Now the question here is, is this really working ? According to some official (maybe outdated) Apple website it should ask for the disk password on boot up, before the login screen.


Output of sudo gpt -r show disk0:

    start       size  index  contents
        0          1         PMBR
        1          1         Pri GPT header
        2         32         Pri GPT table
       34          6         
       40     409600      1  GPT part - XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
   409640  235298960      2  GPT part - XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
235708600    1269536      3  GPT part - XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
236978136          7         
236978143         32         Sec GPT table
236978175          1         Sec GPT header

login or unlock screen?

  • Please add the output of sudo gpt -r show disk0! FV2 is a full volume but no full disk encryption (like VeraCrypt for Windows). – klanomath Feb 22 '17 at 4:46
  • Maybe this is just a confusion. Any account can be allowed to unlock a FV2 volume. You can change that in System Preferences. Sierra shows a pre-boot screen that looks very much like the login screen (e. g. it has a wallpaper). Could it be that it is actually the pre-boot login? – n1000 Feb 22 '17 at 5:43
  • @klanomath edited sudo got -r show disk0 in – Su-Au Hwang Feb 22 '17 at 9:35
  • @n1000 I've added an image of that login/unlock screen. Conny is my non-admin account, there is another account missing that will get displayed after I unlock the disk. But even if that would be the unlock screen, it doesn't really explain why my other account (admin) would show up after I log in with the Conny account and then log out. I do not have to enter my disk password at any point to get full access. – Su-Au Hwang Feb 22 '17 at 10:00
  • FV2 grants your account password permission to unlock the partition. Therefore, your account password = FV2 password. FV2 can use multiple passwords. In System Preferences > Security & Privacy > Enable Users... you can manage which account should be allowed to unlock. – n1000 Feb 22 '17 at 10:12
2

It looks like this is a misunderstanding. In the later versions of macOS it is difficult to distinguish the pre-boot unlock screen (where one unlocks the partition and is automatically logged in after the boot process) from the login screen (where the system partition is already unlocked and the user has to log into the system).

Furthermore, FileVault2 can grant multiple passwords the right to unlock the partition and grants this permission to individual accounts. You can manage what accounts can unlock the system disk in System Preferences>Security & Privacy>Enable Users.... That means your account password also becomes the password to unlock the partition. In any case you can use the recovery password, which is provided when encrypting the disk, to unlock the partition.

This answer provides a method to use a unlock key that differs from your account password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .