In macOS 10.13.6 I have a system I inherited. The previous user is gone. The drive is encrypted but an institutional recovery key that I am familiar with is in place. I need to unlock the encrypted drive and decrypt the drive or change a FileVault user's password in order to pass through the encryption layer, then I need to change the account password.

I put the FileVaultMaster.keychain file on a flash drive and inserted it, then booted into recovery. I was able to unlock the drive with the following commands:

diskutil apfs list    #shows me the list of disks and volumes.
security unlock-keychain /path/to/FileVaultMaster.keychain
#type the password to unlock the keychain
diskutil apfs unlockVolume <MyVolume> -recoverykeychain /path/to/FileVaultMaster.keychain

So far, so good. I get confirmation that the volume is unlocked and mounted, and listing apfs disks again shows the encryption status as "unlocked". "Macintosh HD" appears in /Volumes and I can ls or cd through the directory structure of this volume.

However, I would strongly prefer to not manually copy all user data from command line to an external drive, then wipe and reinstall to whole OS, then copy everything back. I'm trying to either reset a password or decrypt the disk. This page (which is nearly a year old) says that as of macOS 10.13.2 I can't decrypt the volume with an Institutional Recovery Key. Is it correct? Am I out of non-manual options?



You must log in to answer this question.

Browse other questions tagged .