0

This post concerns an Apple iBook G4 running Mac OS X 10.4.11 -- a PowerPC machine. The machine uses the original version of FileVault ("Legacy FileVault") to encrypt (parts of) the user's home directory.

There are two user accounts on this machine which, for purpose of argument, we will call alpha and beta. alpha was the principal, privileged user. It had sudo privileges, was in the wheel group, had console access, could install programs, etc. beta was an unprivileged user: It could only run applications already installed and had no console access.

Sequence of Events

Attempting to free up disk space on this machine, I ran the following command as user alpha:

$ ls -la /Users

and observed these subdirectories with large contents:

/Users/alpha
/Users/.alpha
/Users/beta

(There may have been others, but those are what's necessary to discuss the problem.)

I wanted to find out what was in /Users/.alpha, which I had not previously known existed. I intended to say ls -l /Users/.alpha, but unfortunately when moving backward I ended up typing the equivalent of:

$ rm -rf /Users/.alpha

I then logged off and logged on as user beta. I removed one large file underneath /Users/beta, logged off and attempted to logon as user alpha once again.

At this point, however, when I entered the password I had used for years, I got the "shaking motion" which usually means I have mistyped the password. I repeated the password again, unsuccessfully, and then a third time, at which point the login screen added my "Password hint". But as I was typing the password correctly, that hint didn't get me logged in.

The login display now changed to provide this message:

Type the master password to reset this user's 
password and to unlock FileVault.

It then provided the "Master Password hint", which I typed.

That led me to a popup which said,

Changing the password for this user account creates a 
new keychain to save passwords.  The user's previous 
keychain still exists, you can access the previous 
keychain and the information and passwords it 
contains.

I then pressed "OK".

I then entered a "New Password" and re-entered it into "Verify Password" and provided a "Password Hint". I pressed "Log in" -- but only got the shaking motion indicating that the changes had been rejected. I tried a different new password and hint -- but these were also rejected.

There was a "Back" button here, which I pressed. This took me back to a typical login with "Name" set to alpha. I entered my most recent attempt at a new password and pressed "Log in". At this point I got a popup which said:

You are unable to log in to the user account 
"alpha" at this time.

At this point the same cycle of screens (e.g., master password hint) began once again.

The only thing I could do successfully at this point was to Restart the iBook G4 and log in as user beta. Via the Finder I could navigate to user alpha's home directory and observe that the icons for Desktop, Documents, Library, Movies, Music and Pictures all have a little icon with a white dash on a red background atop their customary folder icons. However, this may simply because user beta never had sufficient privileges to view content in those directories underneath alpha's homedir. Content under /Users/beta is still intact.

Hypothesis as to Cause of Failure

My hunch is that in removing directory /Users/.alpha, I interfered with FileVault's decryption and re-encryption abilities. It may be that after I removed that directory, I was no longer able to re-encrypt the home directory contents when I went to Restart to become user beta. Or perhaps the failure occurred when, after logging off as beta, I tried to logon as alpha once again.

Hypothesis as to Solutions

My hunch is that I need to:

  • Find a way to reboot and get to a console where I can become root.

  • Cause FileVault to decrypt /Users/alpha as needed, and then disable it completely.

  • See if I can login as user alpha.

Questions:

  1. Would that approach be correct?

  2. If so, what steps would I take to implement it?

This machine is old but I use it to test open-source software for backwards compatibility. So really would like to find a solution.

Thank you very much.

migrated from stackoverflow.com Feb 3 at 9:28

This question came from our site for professional and enthusiast programmers.

  • Is there any need to preserve data on this Mac? Do you still have access to the old installation CDs/DVDs? – nohillside Feb 3 at 9:47
  • I really would like to preserve data on this machine if at all possible. When I purchased it, it came installed with Mac OS X 10.3 and I probably have CD/DVD for that. I subsequently updated to 10.4 and continued to update that version until Apple no longer supported it. ISTR that at least once I was able to boot (without using external disc) directly to a console. – James E Keenan Feb 3 at 13:02
  • If it were possible to (a) boot to a console and login as root; then (b) create a new user which could be added to wheel group and to which I could subsequently restart; and (c) disable FileVault, then that would suffice. This machine is currently used for testing software, so I need to be able to install and run git, perl, etc. – James E Keenan Feb 3 at 13:05
  • Did you try to boot with Cmd-S or Cmd-R? – nohillside Feb 3 at 13:55
  • Just now I booted with Cmd-S. The good news: I was able to boot to a console as root. The bad news: Under /Users/alpha, I see only the directories I would have seen upon first boot back in 2004: Desktop, Documents, Library, etc. All of the content I added over 15 years is gone. In most cases each directory contains only a 0-byte file named .localized. Disk usage (df) has gone from 96% to 60%. At this point, other than creating a new user, I don't see that there's anything I can do. – James E Keenan Feb 3 at 14:46

You must log in to answer this question.

Browse other questions tagged .