[macOS Mojave 10.14.6]
I created a bootable external SDD. I apparently didn't follow the traditional path of installing macOS and then enabling FileVault later in settings. Instead, I formatted the new drive using Disk Utility (using AFPS/GUID) and enabled encryption there, setting a password at the time of its creation.
I then installed macOS on the already-encrypted drive (it asked me to enter the password, unlocked the drive, and then proceeded with installation). Somewhere along the way, it asked me if I wanted my iCloud account to be able to recover the disk in case I forgot my password. I foolishly chose iCloud before understanding the implications and risks (i.e. I later learned about elcomsoft).
Now, when I go into settings, it shows that FileVault is enabled, however it does not say anything about a personal recovery key, iCloud, anything else. It just says that it's enabled, and offers me the option to "Turn Off FileVault". I did some digging and discovered some commands:
caffeinatedbits ~$ sudo fdesetup isactive true caffeinatedbits ~$ sudo fdesetup status -extended FileVault is On. FileVault master keychain appears to be installed. Volume is APFS. (FileVault Enabled) caffeinatedbits ~$ sudo fdesetup usingrecoverykey This command is not supported on APFS volumes. caffeinatedbits ~$ sudo fdesetup haspersonalrecoverykey false caffeinatedbits ~$ sudo fdesetup hasinstitutionalrecoverykey false
I can't seem to find anything conspicuous in my iCloud keychain. Just the basic records.
Question #1 How can I verify that my iCloud account has a recovery key?
Question #2 How do I remove that key so that my iCloud account can NOT be used to unlock my drive?