18

I have a volume that is encrypted with OS X Lion's full-disk FileVault. When I enabled FileVault I was given a recovery key, which I wrote down. I'd like to verify that the recovery key that I wrote down is correct before I store it somewhere safe.

How can I verify that a FileVault recovery key is correct?

  • 2
    Excellent question :). Never enter a dark room without checking the exit first. – dan Jul 9 '14 at 16:57
26

This is much easier to do beginning in Mavericks. The fdesetup command was expanded to support recovery key changes and verification.

$ sudo fdesetup validaterecovery
Password:
Enter the current recovery key:
true

This will prompt you for the key, which should be entered in all caps with the hyphens.

true means you entered a valid recovery key.

  • 1
    Just tested this on macOS High Sierra - V10.13.3 and it works fine. A failed attempt give Error: Not a valid recovery key. while a successful attempt give simply true – JFL Feb 20 '18 at 14:38
  • Works on macOS Sierra. tested on 10.12.6 – Gianfranco P. Mar 21 '18 at 13:46
  • Changing to this as the accepted answer as it is a better answer on modern macOS systems. – acm Oct 22 '18 at 0:29
4

You should boot on the Recovery HD and use Terminal there to unlock the drive using the recovery key (you can't check the recovery key if you are booted on the crypted disk, since the unlocking process will fail: already unlocked).

To start with, you will need to identify the Logical Volume UUID of the encrypted drive using the diskutil corestorage list command:

diskutil corestorage list

Running that command will give you a listing of all Core Storage volumes. 

Once you have the UUID of the encrypted volume, you can then unlock the encrypted volume using the following commands:

diskutil corestorage unlockVolume UUID

When prompted enter the passphrase you would like to test.

This article provides more information and screenshots, Unlock or decrypt your FileVault 2-encrypted boot drive from the command line.

  • Excellent and simple procedure with no side effect ;). – dan Jan 2 '14 at 10:37
1

After you enable FileVault2 you will be prompted to restart your Mac.

Upon startup you will be presented with a dialog box asking for your password. Typing in the wrong login password three times will produce a note under the password field which states, "If you forgot your password, you can… …reset it using your recovery key."

Click the triangle-button next to that message to reveal the Recovery Key textfield (which replaces the password textfield)

If the recovery key allows you to login then you know it worked. You will be asked to change your admin password if use the recovery key.

http://support.apple.com/kb/HT4790

  • 1
    OK. That is a little more destructive than I had hoped, but I guess its a good excuse to change my admin password. – acm Jul 11 '12 at 15:34
  • @acm — The recovery key is intended as a last resort if you forget your admin password. – l'L'l Jul 11 '12 at 19:03
  • 2
    Yes, I understand that. But I'd like to verify that my transcription of the recovery key is correct. Trust but verify, etc. Otherwise, when I need it most, it won't be right... So I had hoped there was a utility that would let me determine if a given key was valid. – acm Jul 11 '12 at 19:55
  • 1
    → acm: I agree with your need to check without any side effect. I want to check what I have to trust, otherwise I won't. Excellent question & argument. – dan Dec 31 '13 at 18:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .