I'm currently setting up Carbon Copy Cloner to create a backup clone of my SSD. I'd like to be able to store the cloned drive's Filevault 2 password in the keychain so CCC can access it to automatically do backups on a schedule. However, I don't want to store my administrator password in the keychain. (I've heard of a few exploits that allowed malware to access stored passwords).

Is there a way to set up a separate Filevault password for the cloned drive?

I'm running a MacBook 8,1 with El Capitain 10.11.6.

  • 1
    Are you talking about the FV password of the source drive (the one in your Mac) or of the backup drive? – nohillside Dec 5 '17 at 22:49
  • The FV password for the backup drive. – Bruce Dec 6 '17 at 2:20
  • A drive password is different from a login password, so Right know I don‘t fully understand your problem. Can you elaborate a bit more on where the admin password comes into play here and how it seems that they must be the same? – nohillside Dec 6 '17 at 5:23
  • To backup what @patrix stated, the FileVault 2 password is for the encrypted drive. It is encrypted on boot up. This FileVault password is stored in the keychain which is the accessed when you login with your user, since the user's password unlocks the keychain the FileVault password is in. – Jahhein Dec 7 '17 at 17:04
  • @patrix According to Apple, the way it works is: "When FileVault setup is complete, your Mac restarts and asks you to log in with your account password. Your password unlocks your disk and allows your Mac to finish starting up." Bombich also recommends you clone to an unencrypted disk, then boot into it and enable FileVault. When you enable it, there is no option to set a separate disk password. In fact, all new user accounts' passwords will also decrypt the disk. – Bruce Dec 7 '17 at 18:30

No, you can't have CCC be able to unlock a drive without storing those credentials somewhere. The best you could do is create a new account that has the ability to unlock the drive and store those credentials instead, which unlocks the drive but not your primary administrator account.

| improve this answer | |
  • This worked, but there was one hiccup. Since I had set up FileVault on the external drive before I had created the second user on the internal drive, I had to manually enable the second users account in FileVault on the external drive. It was automatically enabled on the boot drive, but that setting was not carried over via cloning. I also made that second user "Managed" under parental controls and revoke every privilege I could. So, as much as possible, it functions solely as a password for the disk. – Bruce Dec 12 '17 at 4:28
  • I also found some instructions to set up a separate password without creating a second user. It makes booting from the external drive slightly more complicated as my admin password would no longer unlock the drive at all. Also, while I did not try it, diskutil coreStorage changeVolumePassphrase may also be an option. – Bruce Dec 12 '17 at 4:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .