0

Apple has released this support document for FileVault 2 in Lion which says:

FileVault 2 uses full disk, XTS-AES 128 encryption to help keep your data secure. With FileVault 2 you can encrypt the content of your entire drive.

I understand that full disk encryption requires me to enter the login password right upon start and before the boot process.

But why then can I boot into the recovery partition without entering a password?

Improve this question

1 Answer 1

Reset to default
1

This is because you are booting into a separate partition on your hard drive. FileVault identifies volumes via partitions so when you encrypt your "hard drive" it is the partition that contains your boot volume and data only. The recovery partition and any other additional partitions are never encrypted.

This isn't cause for certain though since booting to the Recovery Partition does not expose your encrypted volume nor does doing so grant you access to it. As a matter of fact, if you need to repair your user folder's ACL's and permissions; which you would do through your recovery partition, you would have run some terminal commands to unlock your encrypted partition before repairs can be done.

Boot Camp would serve as a good example of this. With Boot Camp, your hard is now partitioned into two volumes; One for Mac OS and another for Windows. This would add up to three partitions on your hard drive. FileVault would only encrypted your Macintosh HD partition and not touch your Windows and Recovery partition; but at no point would you be able to access your Macintosh HD's content via Windows or Recovery Mode.

Improve this answer
4
  • So here full-disk-encryption actually means "full-partition-encryption"? I guess that I'm confused by the ambiguity of the term disk.
    – gentmatt
    Apr 13, 2012 at 19:40
  • 1
    It is slightly misleading, but most users don't understand the concept of partitions and volumes so it would be easier for Apple to advertise this feature in the simplest of ways as possible. Being an IT Manager, I have lots of hands on experience with this reality ;)
    – Nicholas Arvelo
    Apr 13, 2012 at 19:45
  • In truth though, I would expect most users would enable Firevault and be happy with knowing their data is secure and never ever see or use the built in Recovery Partition. So Apple explaining the technicalities of FireVault and Partitions would be TMI for most.
    – Nicholas Arvelo
    Apr 13, 2012 at 19:47
  • The answer is slightly incorrect. By default FileVault 2 encrypts the system partition only, but one can encrypt any other data partition that appears in /Volumes (see hints.macworld.com/article.php?story=20110723223309186). The recovery partition pr Boot Camp partitions are different types of partitions (and do not appear in /Volumes) and can't be encrypted. That doesn't change the answer in the part pertaining to the recovery partition, which was the original question; but changes it slightly when it refers to non-system and non-recovery partitions or non-BootCamp partitions.
    – lupincho
    Apr 13, 2012 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .