I have a filevault2 disk with two partition. One is the boot partition, the other contains data, both are encrypted.

Today, after installing the latest 10.8 update (10.8.4 I guess), the computer reboots, asks for the user password at EFI (filevault2) and starts in verbose mode as usual.

Unfortunately, the boots hangs with a line:

CoreStorageFamily::unlockVEKs() failed to unwrap the vek, status = e00002bc

I can boot in single user mode and execute fsck_cs. The drive appears undamaged (so says fsck_cs) but again, the error message about the-said VEKs is printed on the screen. The second partition, the one that contains the data is the one causing the issue.

What can I do to get back my precious data ?

EDIT: It appears both volumes can be mounted as external disk from an other MAC computer. So, what's with the VEK preventing the system to boot ?

  • I get that message whenever I connect a USB drive to my Mac and the drive works/mounts normally. On an already running system, that message is not indicative of any failure and doesn't prevent keychain from grabbing the passcode and unlocking. It could still be a problem for booting from a FileVault 2 protected OS, but I wanted to see if you have other messages surrounding it in case this is a false positive. Being the last message, that's less likely but possible nonetheless.
    – bmike
    Mar 6 '14 at 16:40

I noticed fsck_hfs running when i get this error.

So i suspect that the volume needed to be fsck'd, and because this sometimes can take longer than the time the authentication is supposed to take, an error got signalled by the authentication dialog, leading to the e00002bc error in the system log.

A look at /var/log/fsck_hfs.log will tell you if this is what happened in your case.

On my 4T external disk the fsck took about 5 hours.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .