0

I have a MacBook (Retina, Mid 2012 if it's relevant) which I installed Mountain Lion onto, creating one user account only (an Admin account). There is a Guest User, marked for "Sharing Only". The hard drive was encrypted with FileVault 2 at the time of install, and the recovery key stored away.

For various reasons the password to my user account was disclosed (but NOT the FileVault recovery key). I changed the password on my user account before it could be used, but the old password is still known.

Is the old password still retained with respect to the FileVault partition, and might enable someone to decrypt the FileVault-encrypted drive? Put another way, are my new password and the recovery key the only way to decrypt the FileVault partition?

Improve this question
1
  • 1
    I don't know the definitive answer to your question, but similar systems (a) encrypt the volume with a master key and (b) encrypt copies of the master key with each password/phrase that is allowed to unlock that volume. When you change your password, it should remove your old-password-encrypted key and replace it with a new-password-encrypted key. Have you tried going into recovery boot, opening Disk Utility, and attempting to unlock the volume with your old password?
    – Mattie
    Commented Apr 10, 2013 at 17:58

2 Answers 2

Reset to default
1

Once you change the password, it has been charged and the old password can not access the FileVault decryption protocol. It would be nightmarish if you had to always remember any and all passwords ever used by the FileVault account(s).

If you want really great info to FileVault please watch: http://docs.macsysadmin.se/2013/video/Day2Session5.mp4

Improve this answer
0

You need a current working password for your filevaulted system. Anyone who has access to such can unlock the file system. The recovery key will always be the emergency key when you forget your passcode. Think of that as your key under the rug at your house. Safely store that so you can gain access in the worst case scenario. Remember if you enabled the option when you activated filevault to store ur recovery key with apple, they can access that for you if you lose it. If you are worried the FEDS are getting into your encrypted hard drive. well you might as well say bye bye.

Here is a good site to read about how it works and what it does: http://afp548.com/2012/06/05/filevault-2-the-silent-protector/

*Edit

Also read this, "When FileVault is turned on, guest users can only log in and use Safari. Guests can’t access your FileVault-encrypted disk or create files. Instead, they log in and use Safari from your computer’s built-in recovery disk." support.apple.com/kb/PH11321

Guest account boots in a different partition that does not have access to the encrypted partition

The question your asking is confusing: The password to unlock the encrypted drive is whatever your password is to login to your user account. I don't understand your problem. If you changed your user account password. Use the new user account password to unlock the system-or recovery key if necessary. Could you elaborate anymore?

Improve this answer
1
  • Thanks. This doesn't really address my question, however. I understand what the recovery key is for. My question is really whether there is a separate password for the encrypted partition which is NOT my user's password or the recovery key, which by default (I could imagine) was set to be the same as the old password, and which may not have been changed when mine was compromised.
    – Andrew Ferrier
    Commented Apr 10, 2013 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .