For my backups I use an encrypted external hard disk. This hard disk has two partitions (names are: Backup, Private).

Today, when connecting the backup I was prompted with the following message:

enter image description here

  • What does this mean?
  • Why am I prompted by this after connecting the external disk?

About the hard disk

  • The hard disk is encrypted using Disk Utility.app.
  • Both volumes are Mac OS Extended (Journaled, Encrypted)
  • In Disk Utility I can see that the volume Private has no owners enabled while Backup has owners enabled.


Maybe the following info helps in answering the question of why I'm prompted with this now. The last time, that I've connected the hard disk, I've done the following:

  • erase the Backup partition (which required a new password)
  • The system provided Core Services User Agent (/System/Library/CoreServices/CSUserAgent) is clearly a system program and you can inspect the md5 and compare it with other macs to ensure it's not modified, but are you more interested in why this is happening or what is happening to cause this now? – bmike Mar 6 '12 at 15:39
  • 1
    @bmike I want to know everything :) – gentmatt Mar 6 '12 at 15:44

In a nutshell, CSUserAgent is part of the core Mac OS X system where the security is handled. In this case, it seems like an innocent warning and intended ask to make sure you are intending the encrypted backup to be used now.

You can verify this by opening up Keychain Access and looking at the item in your keychain. Here is a view of one of my portable hard drives that is encrypted with FileVault.

enter image description here

The Access Control tab will show you if any apps have been signed and trusted to access this item without further prompting - so unless you have some odd problem, your system is prompting you for the normal and usual tool that reads items from the keychain since you haven't white listed the task that normally does that job.

enter image description here

You can learn a little about the infrastructure from Apple at the Core Services Layer documentation as well as by using mdfind CSUserAgent from the terminal to locate where this program really lives on your mac. The keychain help and support articles are nice as well for reference.

| improve this answer | |
  • Thanks for your answer! So, I guess this prompt was due to me not having stored the new password in the keychain after the disk erase. However, I set the erased disk to have the same volume name and password. Therefore, CSUserAgent could notice that there is a key stored in my keychain and - when connecting the external disk - prompted me. – gentmatt Mar 6 '12 at 16:29
  • 1
    The area is a little "quirky" still. With encrypted volumes - the system will prompt for that password and access the keychain from outside the user space. The boundaries between a user keychain and a system keychain and whether the tokens are stored in user process memory is a bit confusing. You'll find you have to "re-authorize" things more than usual in the case where the system first boots to a recovery or firmware/netboot image and then asks to mount drives. These changes may be rippling into the "normal" keychain as small quirks like this. – bmike Mar 6 '12 at 16:31

I believe the CSUserAgent is related to Core Storage and the warning is asking you for permission to give that agent access to the password (or encryption key) for your backup drive.

It's difficult to be more specific because you don't tell us how your drives are encrypted, what software you're using to do the backups, how the drive was mounted, etc.

Assuming nothing nefarious is happening here (and, based on the limited information you provide, that would be my assumption) I would open Keychain Access, search for Encrypted Volume Password and make certain that CSUserAgent is listed as an application that always has access.

| improve this answer | |
  • You're quicker, but I brought pictures ;-) – bmike Mar 6 '12 at 15:57
  • I don't keep encrypted volume passwords in my Keychain so I had nothing to photograph. ;) – jaberg Mar 6 '12 at 16:35
  • @jaberg Didn't you say you use a separate keychain for such things? – gentmatt Mar 6 '12 at 16:39
  • I said you could do so. I store my encryption keys and passwords in Password Wallet. – jaberg Mar 6 '12 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .