6

[macOS Mojave 10.14.6]

I created a bootable external SDD. I apparently didn't follow the traditional path of installing macOS and then enabling FileVault later in settings. Instead, I formatted the new drive using Disk Utility (using AFPS/GUID) and enabled encryption there, setting a password at the time of its creation.

I then installed macOS on the already-encrypted drive (it asked me to enter the password, unlocked the drive, and then proceeded with installation). Somewhere along the way, it asked me if I wanted my iCloud account to be able to recover the disk in case I forgot my password. I foolishly chose iCloud before understanding the implications and risks (i.e. I later learned about elcomsoft).

Now, when I go into settings, it shows that FileVault is enabled, however it does not say anything about a personal recovery key, iCloud, anything else. It just says that it's enabled, and offers me the option to "Turn Off FileVault". I did some digging and discovered some commands:

caffeinatedbits ~$ sudo fdesetup isactive
true
caffeinatedbits ~$ sudo fdesetup status -extended
FileVault is On.
FileVault master keychain appears to be installed.
Volume is APFS. (FileVault Enabled)
caffeinatedbits ~$ sudo fdesetup usingrecoverykey
This command is not supported on APFS volumes.
caffeinatedbits ~$ sudo fdesetup haspersonalrecoverykey
false
caffeinatedbits ~$ sudo fdesetup hasinstitutionalrecoverykey
false

I can't seem to find anything conspicuous in my iCloud keychain. Just the basic records.

Question #1 How can I verify that my iCloud account has a recovery key?

Question #2 How do I remove that key so that my iCloud account can NOT be used to unlock my drive?

Improve this question

1 Answer 1

Reset to default
8

You can run this command from the terminal to verify that your iCloud account has a recovery key:

sudo fdesetup list -verbose -extended

The list should include your OS users as well as a "iCloud Recovery Record".

The easiest way to remove the recovery key from the GUI is simply to disable FileVault 2 and then enable it again afterwards (this time do not store the recovery key in iCloud ofcourse). The process does take considerable time, but you can use the computer while it processes.

Improve this answer
5
  • That returns a list of "OS Users" only. Escrow column is empty for all, only UUID, "OS User", and account username. So does that mean it never stored the key in my iCloud account?
    – caffeinatedbits
    Commented Mar 18, 2021 at 17:51
  • It seems that way, yes. Normally when you format a disk encrypted with Disk Utility, you're not even given the option of storing a recovery key in iCloud!
    – jksoegaard
    Commented Mar 18, 2021 at 18:05
  • I wasn't given the option until I ran the installer to install Mojave. I don't remember exact details because I was up for probably 30 hours at the time and it's all a little foggy. Now thinking back, I do recall not being able to log into my iCloud during the install though. That may have been why it was never added. So, to confirm, the only way to be 100% sure is to unencrypt the disk, and then start over from scratch? I can't just change the personal and institutional keys to new ones and call it a day?
    – caffeinatedbits
    Commented Mar 18, 2021 at 18:42
  • Well, you have just checked with the command I gave you, and there's no iCloud Recovery Key, so you're already good to go. But yes, unencrypting the disk and starting over from scratch will ofcourse make any old keys unusable. Changing the personal/institutional keys do not have any impact on the iCloud Recovery Record.
    – jksoegaard
    Commented Mar 18, 2021 at 18:44
  • Seems silly that one can change all other keys, but cannot remove iCloud. That should definitely be an option! Thanks for your help!
    – caffeinatedbits
    Commented Mar 18, 2021 at 18:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .