Which encrypted items show a hint?

Question

I encrypted some drives with Disk Utility and set a password hint. This hint does not show on a different computer. It's embarrassing because those were backup drives and losing the computer means also losing the key to the backup.

However, I found out by chance, when I was doing a boot from a live USB, that hints for startup disk encryption do show their password hints, as shown in this example:

Could anyone confirm that password hints for drives encrypted with Disk Utility are saved on the local computer and do not show on different drives, ideally with a reference?

And in which cases do encrypted drives store their hints, as in the startup disk example above?

Update: I am running macOS 10.14.6. Here is a screenshot of the drive encrypted with Disk Utility that does not show a hint:

I believe that I chose MacOS Extended (Journaled, Encrypted) as the format in Disk Utility.app for the drives that do not show a hint. Here is the result of diskutil list with the two drives connected, one that shows a hint and is decrypted, the other that does not show a hint and is locked:

$ diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *121.3 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:                 Apple_APFS Container disk1         121.1 GB   disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +121.1 GB   disk1
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            105.0 GB   disk1s1
   2:                APFS Volume Preboot                 45.5 MB    disk1s2
   3:                APFS Volume Recovery                510.4 MB   disk1s3
   4:                APFS Volume VM                      2.1 GB     disk1s4

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *240.1 GB   disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:          Apple_CoreStorage Time Machine Encryped   239.7 GB   disk2s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk2s3

Offline
                                 Logical Volume Time Machine Encryped on disk2s2
                                 2930C7CC-4EE4-43AB-B1FB-81756A1CC0E5
                                 Locked Encrypted

Answer 1

The password hints are not stored on the local computer as such.

Instead for APFS it is stored on the encrypted drive itself in the "volume passphrase hint" key bag. You can read the specifics here APFS File System Reference.

For HFS+ it is stored in the "PassphraseHint" entry of the "CryptoUsers" structure in the "com.apple.corestorage.lvf.encryption.context" structure in the CoreStorage XML plist on the encrypted drive. You can read the specifics here FileVault Drive Encryption

Note that password hints are only stored for passphrase (i.e. password) protected drives.

Therefore I cannot confirm your assumption. This is always the case.

Note: In the answer from lx07 I see that he concludes that the hint is not stored on the drive after looking for it with a hexeditor. That is not correct. The PLIST is compressed using DEFLATE and the hint itself might be base64 encoded. You'll need to decompress the data before searching for the hint, if you want to find it manually that way.

In addition take note of section 7 of the reference FVDE document (The encryption context plist) - namely that depending on your setup the PLIST containing hint could be located outside the encrypted partition, and instead be stored on the "Recovery HD" partition on the same physical drive. It can be stored either in unencrypted or encrypted form. In case of encrypted form, the AES-XTS key is the volume identifier of the encrypted volume (i.e. the key is stored non-encrypted on the drive).

Answer 2

For APFS volumes the hint is stored on the volume. See Apple File System Reference.pdf

Page 120

The volumeʼs keybag might contain a passphrase hint for the user (KB_TAG_VOLUME_PASSPHRASE_HINT), which you can display when prompting for the password.

Page 131

KB_TAG_VOLUME_PASSPHRASE_HINT The key data stores a userʼs password hint as plain text.

This will show a hint when you try to open it.

Encrypted HFS (macOS Extended) however doesn't have the Show Hint/Hide Hint button :

Unlike for APFS I could not find detailed documentation for the layout of CoreStorage volumes but looking with hex editor of an encrypted HFS volume the hint is not stored in plaintext. EDIT: See the answer by jksoegaard for how it is stored and link to FireVault Drive Encryption documentation.

This was tested on Mojave version 10.14.6 - whether the Show Hint button was shown on earlier versions I do not remember.

This issue of encrypted HFS+ volumes not showing hint is discussed more in this unresolved question - How do I get the password hint for an encrypted disk?