0

I encrypted some drives with Disk Utility and set a password hint. This hint does not show on a different computer. It's embarrassing because those were backup drives and losing the computer means also losing the key to the backup.

However, I found out by chance, when I was doing a boot from a live USB, that hints for startup disk encryption do show their password hints, as shown in this example:

Disk encrypted showing password hint on different computer

Could anyone confirm that password hints for drives encrypted with Disk Utility are saved on the local computer and do not show on different drives, ideally with a reference?

And in which cases do encrypted drives store their hints, as in the startup disk example above?

Update: I am running macOS 10.14.6. Here is a screenshot of the drive encrypted with Disk Utility that does not show a hint:

Dialog for decryption that does not show a hint

I believe that I chose MacOS Extended (Journaled, Encrypted) as the format in Disk Utility.app for the drives that do not show a hint. Here is the result of diskutil list with the two drives connected, one that shows a hint and is decrypted, the other that does not show a hint and is locked:

$ diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *121.3 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:                 Apple_APFS Container disk1         121.1 GB   disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +121.1 GB   disk1
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            105.0 GB   disk1s1
   2:                APFS Volume Preboot                 45.5 MB    disk1s2
   3:                APFS Volume Recovery                510.4 MB   disk1s3
   4:                APFS Volume VM                      2.1 GB     disk1s4

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *240.1 GB   disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:          Apple_CoreStorage Time Machine Encryped   239.7 GB   disk2s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk2s3

Offline
                                 Logical Volume Time Machine Encryped on disk2s2
                                 2930C7CC-4EE4-43AB-B1FB-81756A1CC0E5
                                 Locked Encrypted

2 Answers 2

2

The password hints are not stored on the local computer as such.

Instead for APFS it is stored on the encrypted drive itself in the "volume passphrase hint" key bag. You can read the specifics here APFS File System Reference.

For HFS+ it is stored in the "PassphraseHint" entry of the "CryptoUsers" structure in the "com.apple.corestorage.lvf.encryption.context" structure in the CoreStorage XML plist on the encrypted drive. You can read the specifics here FileVault Drive Encryption

Note that password hints are only stored for passphrase (i.e. password) protected drives.

Therefore I cannot confirm your assumption. This is always the case.

Note: In the answer from lx07 I see that he concludes that the hint is not stored on the drive after looking for it with a hexeditor. That is not correct. The PLIST is compressed using DEFLATE and the hint itself might be base64 encoded. You'll need to decompress the data before searching for the hint, if you want to find it manually that way.

In addition take note of section 7 of the reference FVDE document (The encryption context plist) - namely that depending on your setup the PLIST containing hint could be located outside the encrypted partition, and instead be stored on the "Recovery HD" partition on the same physical drive. It can be stored either in unencrypted or encrypted form. In case of encrypted form, the AES-XTS key is the volume identifier of the encrypted volume (i.e. the key is stored non-encrypted on the drive).

7
  • I updated the question with details on the drive that does not show a hint and why I assumed that hints are stored on the local computer. Oct 3, 2019 at 9:03
  • 1
    @miguelmorin Please add information about which version of macOS you're running. Password hint display has seen some changes in the recent versions. Have you tried APFS formatting instead of HFS+ to see if that solves the problem for you? (note that formatting the drive will delete all files, so you'll need some place to store those files in the mean time)
    – jksoegaard
    Oct 3, 2019 at 9:05
  • I updated the question: it's macOS 10.14.6. Yes, formatting a drive with APFS and a hint shows the hint when connecting the drive. If the password hint for the drive probably formatted as HFS+ was not stored in the local computer, then it must be in the volume somewhere and I want to see it. Shall I post as a separate question? Oct 3, 2019 at 9:41
  • 1
    It is not stored on the local computer. I wrote in my answer where it is stored on the local drive. if you’re not familiar with terms such as key bags, you’ll probably not be able to follow for example the specification linked in the other answer. If you know your hint, you could simply open up your drive in a text editor and search for it. I.e. open the drive as a raw disk (/dev/rdiskX) - not by searching the files on it, as it is not stored in a file.
    – jksoegaard
    Oct 3, 2019 at 11:38
  • 1
    Good find for the FVDE document.
    – lx07
    Oct 3, 2019 at 15:48
1

For APFS volumes the hint is stored on the volume. See Apple File System Reference.pdf

Page 120

The volumeʼs keybag might contain a passphrase hint for the user (KB_TAG_VOLUME_PASSPHRASE_HINT), which you can display when prompting for the password.

Page 131

KB_TAG_VOLUME_PASSPHRASE_HINT The key data stores a userʼs password hint as plain text.

This will show a hint when you try to open it.

APFS volume

Encrypted HFS (macOS Extended) however doesn't have the Show Hint/Hide Hint button :

HFS volume

Unlike for APFS I could not find detailed documentation for the layout of CoreStorage volumes but looking with hex editor of an encrypted HFS volume the hint is not stored in plaintext. EDIT: See the answer by jksoegaard for how it is stored and link to FireVault Drive Encryption documentation.

This was tested on Mojave version 10.14.6 - whether the Show Hint button was shown on earlier versions I do not remember.

This issue of encrypted HFS+ volumes not showing hint is discussed more in this unresolved question - How do I get the password hint for an encrypted disk?

2
  • Good to know! I updated the question with details on the formatting. Could the difference come from APFS versus MacOS Extended format of the encryption? Oct 3, 2019 at 9:03
  • Yes that seems to be the difference - see edited answer.
    – lx07
    Oct 3, 2019 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .