1

I had a Mac computer running macOS 10.14.6 (I believe) and set up a Time Machine backup with encryption on a hard drive. It is encrypted with HFS+ with a password and a hint. The password was stored on the local keychain and I ran backups 3 times a week.

Then I got my computer stolen. I connect the encrypted drive to another computer and I do not see the hint (it seems an unresolved issue):

I contacted Apple for support and visited a store, but they adamant that the hint is not on the drive, and that doing so would be a security risk. This seems backwards to me because then there is no advantage to having a hint if it only shows on the same device where you can save the password in the first place.

By chance I discovered that APFS drives do show a hint. As for HFS+:

[the hint] is stored in the "PassphraseHint" entry of the "CryptoUsers" structure in the "com.apple.corestorage.lvf.encryption.context" structure in the CoreStorage XML plist on the encrypted drive. You can read the specifics here FileVault Drive Encryption

The same thread shows that this CoreStorage XML plist on the encrypted drive is encoded:

The PLIST is compressed using DEFLATE and the hint itself might be base64 encoded. You'll need to decompress the data before searching for the hint, if you want to find it manually that way.

and that PLIST may be outside the encrypted partition:

The encryption context plist either the EncryptedRoot.plist.wipekey stored on the "Recovery HD" partition of the system disk that also contains the FileVault encrypted volume, or the XML plist-like data identified as "com.apple.corestorage.lvf.encryption.context" stored in the encrypted metadata, contains the encrypted VMKs necessary to unlock the encrypted volume.

How user's name can be displayed before disk is decrypted, when FileVault is turned on? handles a related question where a drive has a Preboot volume. Following those steps, I ran:

$ diskutil list
/dev/disk0 (internal, physical):
...
/dev/disk1 (synthesized):
...
/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *240.1 GB   disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:          Apple_CoreStorage Time Machine Encryped   239.7 GB   disk2s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk2s3

Offline
                                 Logical Volume Time Machine Encryped on disk2s2
                                 2930C7CC-4EE4-43AB-B1FB-81756A1CC0E5
                                 Locked Encrypted

Following one answer the hint should be in the Apple_CoreStorage volume itself. I mount that volume with:

$ sudo mkdir /Volumes/Apple_CoreStorage
$ sudo mount -t hfs /dev/disk2s2 /Volumes/Apple_CoreStorage

and I get prompted for the encryption password in the same way as if I had mounted it:

computer prompt for password

How can I find the bytes that contain the CryptoUsers or CoreStorage XML plist on the encrypted drive, decode them with base64, and see the hint in plaintext?

1 Answer 1

1

I detailed how to find the hint in my earlier answer to you here:

Which encrypted items show a hint?

In particular, the hint is NOT stored on the EFI or boot partitions. It is stored (if it is indeed stored on the drive) inside the encrypted partition (the one named "Time Machine Encryped" in your case).

As I detailed in my earlier answer, this particular information is NOT encrypted with your actual passphrase (which would have defeated the purpose of a password hint), instead it is encrypted with a different key (derived from the volume identifier). So essentially the key for decrypting the information is stored in cleartext on the the drive itself.

5
  • Yes, indeed, and that was very helpful. But I still cannot find the hint, even in the actual drive. Since your answer there finished the scope of that question, I started a new thread. You mention "If it is indeed stored on the drive": why would it not be, since it seems an Apple specification? How can I find if it is stored on the drive or not?
    – emonigma
    Aug 1, 2022 at 12:41
  • 1
    It was just a general “safe guard”, you do not need to worry about it. For example if it were a system disk, the hint would be stored in the Recovery HD volume instead.
    – jksoegaard
    Aug 1, 2022 at 14:03
  • 1
    Are you a programmer, or what is level of skill with computers? I have explained in my answers where the hint is stored on the drive. The answer on what to do from here depends on your skill level. A programmer can use the linked library and specifications to access the hint. A novice will need to seek help.
    – jksoegaard
    Aug 1, 2022 at 14:04
  • Yes, I do high-level programming in Python. I'm sorry that I only saw the documentation reference and not the library libfvde in your previous answer. It has Python bindings. So now I just need to get my hands dirty with that library and the reference documentation, right?
    – emonigma
    Aug 1, 2022 at 14:46
  • 1
    That's one way of going about it - but if it were me, I would just start with the tools supplied. I.e. try running fvdeinfo and fvdemount on it with a lot of verbosity - just to see if the structure is intact and how much information it will give you without having to do any custom programming.
    – jksoegaard
    Aug 1, 2022 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .