2

I'm currently setting up Carbon Copy Cloner to create a backup clone of my SSD. I'd like to be able to store the cloned drive's Filevault 2 password in the keychain so CCC can access it to automatically do backups on a schedule. However, I don't want to store my administrator password in the keychain. (I've heard of a few exploits that allowed malware to access stored passwords).

Is there a way to set up a separate Filevault password for the cloned drive?

I'm running a MacBook 8,1 with El Capitain 10.11.6.

8
  • 1
    Are you talking about the FV password of the source drive (the one in your Mac) or of the backup drive?
    – nohillside
    Dec 5, 2017 at 22:49
  • The FV password for the backup drive.
    – Bruce
    Dec 6, 2017 at 2:20
  • A drive password is different from a login password, so Right know I don‘t fully understand your problem. Can you elaborate a bit more on where the admin password comes into play here and how it seems that they must be the same?
    – nohillside
    Dec 6, 2017 at 5:23
  • To backup what @patrix stated, the FileVault 2 password is for the encrypted drive. It is encrypted on boot up. This FileVault password is stored in the keychain which is the accessed when you login with your user, since the user's password unlocks the keychain the FileVault password is in.
    – Jahhein
    Dec 7, 2017 at 17:04
  • @patrix According to Apple, the way it works is: "When FileVault setup is complete, your Mac restarts and asks you to log in with your account password. Your password unlocks your disk and allows your Mac to finish starting up." Bombich also recommends you clone to an unencrypted disk, then boot into it and enable FileVault. When you enable it, there is no option to set a separate disk password. In fact, all new user accounts' passwords will also decrypt the disk.
    – Bruce
    Dec 7, 2017 at 18:30

1 Answer 1

4
+50

No, you can't have CCC be able to unlock a drive without storing those credentials somewhere. The best you could do is create a new account that has the ability to unlock the drive and store those credentials instead, which unlocks the drive but not your primary administrator account.

7
  • This worked, but there was one hiccup. Since I had set up FileVault on the external drive before I had created the second user on the internal drive, I had to manually enable the second users account in FileVault on the external drive. It was automatically enabled on the boot drive, but that setting was not carried over via cloning. I also made that second user "Managed" under parental controls and revoke every privilege I could. So, as much as possible, it functions solely as a password for the disk.
    – Bruce
    Dec 12, 2017 at 4:28
  • I also found some instructions to set up a separate password without creating a second user. It makes booting from the external drive slightly more complicated as my admin password would no longer unlock the drive at all. Also, while I did not try it, diskutil coreStorage changeVolumePassphrase may also be an option.
    – Bruce
    Dec 12, 2017 at 4:34
  • But doesn't this login the user after filevault? I don't want the user to login. Just to unlock the disk. Seems Apple is helping NSA a bit too much here. Why force people to use a frequently used password to be the same as the one for filevault.
    – mjs
    Apr 30 at 20:19
  • @mjs yes it does. What does this have to do with the NSA? I think there's a way to give a non-administrative user FileVault unlock privileges, that might address your concerns as it would unlock the disk but only log you into an empty user profile. Then you can log out and into the one you really want, with a separate password.
    – Harv
    May 1 at 1:51
  • I am already at that point. I just don't want to be logged in and out. I prefer if I was able to get to the login screen and choose later how to log in. Very obtrusive, especially if you have several disks to be unlocked. There are issues with this approach. I am just saying that by default they've connected the filevault password to the user password which we enter daily hundreds of times. Prior they used to allow a disk password that was separate, or even, change the user password so that the login would fail. Now, they longer allow a disk password, just a user connected one.
    – mjs
    May 1 at 8:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .