15

I've been researching FileVault 2 to make sure that I understand it before I enable it on my Mac. While reading Macworld's Complete guide to FileVault 2 in Lion, I encountered an unexpected caveat (emphasis mine):

It's probably worth mentioning that someone who steals a FileVault-enabled Mac can never shut down or restart the machine without losing access to the booted machine's startup drive. (Although they probably wouldn't realize this until after shutting down or restarting.) This also means they can't install updates that require a restart, let the battery run down to zero, or even wipe the hard drive clean and reinstall the OS to get a "working" computer.

This doesn't make sense to me. In my mental model of FileVault 2, a tiny decryption program stored on the hard drive is loaded during the boot process. This program asks the user for the key and uses it to begin decrypting the drive and start the OS. If you were to reinstall the OS, it would overwrite the decryption program and boot normally.

Why can't you reinstall the OS on a FileVault 2-encrypted drive?

1
  • 2
    While the answer does not agree with this, I know that I have reformatted and installed Lion over my FV2 encrypted partition when I "lost" my password. (In fact, this was a bug where 10.7.0 would randomly change the keyboard layout.)
    – gentmatt
    Jun 29, 2012 at 8:03

2 Answers 2

4

When you try to run the OS X installer it will refuse to install to a disk encrypted with FV2 and Disk Utility will refuse to partition or erase FV2 volumes.

That being said, if you know your cli-fu you can destroy the partitions using the Terminal app included on the installer (which I've done, although now I don't remember if I used diskutil or just brute forced it by overwriting the partition table with dd, point being that it can be done).

11

If you don't care about the data, it's pretty standard (almost doesn't quality as "cli-fu" even); from Recovery HD, you can do it all in Terminal (Utilities > Terminal)

First, do a diskutil cs list to see the CoreStorage information on the volume. Grab the longish UUID of the Logical Volume Group you want to nuke (typically near the top of the output; scroll up). Now, diskutil cs delete UUID (where UUID is the LVG's UUID). Requires no knowledge of the key or an authorized user. Just blows the volume away.

Again, if you don't care about the data. A completely legitimate example of this is a laptop my predecessor used to test FileVault 2. Didn't use an Institutional key or a local one he left where anybody could find it, and his account was the only authorized user.

1
  • 1
    Worked perfectly. Completely destroyed the data but I don't care. Aug 29, 2014 at 22:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .