Skip to main content

How to decrypt the Filevault encrypted volume using Recovery HD ?

There might be a time where you want decrypt the FileVault encrypted mac, but you are facing issues in logging into Mac to perform decryption using system preferences. In such cases the following steps will help you in decrypting the disk using Recovery HD.
  1. Reboot the Mac, Go to recovery HD partition of the system. (To start your computer from Recovery, restart your Mac and hold down the Command and R keys at startup.)
  2. Open Terminal application from Utilities -> Application. 
  3. First will need to identify the Logical Volume UUID of the encrypted drive using the diskutil corestorage list command:
          diskutil corestorage list 


      4.  Once you have the UUID of the logical volume as shown in above picture, you can then either             unlock or decrypt the encrypted volume using the following commands.

      a) Using the password of an authorised account or the recovery key ( Provided by the                                FileVault at the time of enabling it) on the command line
  
           To unlock: diskutil corestorage unlockVolume UUID –stdinpassphrase  

           The -stdinpassphrase flag will cause the command to prompt you for the password/passphrase
          of an account that’s authorised to unlock the encryption or the recovery key for the system. If              successful, the drive will unlock and mount.

      5.   Once we have unlocked the disk, we can now decrypt the volume.
        
            To decrypt: diskutil corestorage revert UUID –stdinpassphrase  

          You’ll be prompted for the password/passphrase of an account that’s authorised to unlock the              encryption or the recovery key. Once provided, decryption of the encrypted volume will                      begin. To track its progress, you can use the diskutil corestorage list command. Once the drive            has been completely decrypted, it will no longer be listed as a CoreStorage volume by diskutil            corestorage list. In Disk Utility, it will appear as a normal hard drive.  

      6.   Reboot the mac , It is now no longer encrypted with FileVault.



  

Labels:

Comments

  1. La Chica con el Tatuaje de DragonTuesday, October 16, 2018

    No luck. No corestorage logical volume group found. Any idea?

    ReplyDelete
  2. La Chica con el Tatuaje de DragonTuesday, October 16, 2018

    I got the UUID and the user password of course but nothing. It's Mojave updated from High Sierra MacBook pro

    ReplyDelete

Post a Comment

Popular posts from this blog

How to extract signing certificates from macOS binary files

Code signing is a macOS security technology that you use to certify that an app was created by you. Once an app is signed, the system can detect any change to the app—whether the change is introduced accidentally or by malicious code. As Apple Developer site says ( click here for more details  on code signing) : code signing allows the operating system to: Ensure that a piece of code has not been altered since it was signed.  The system can detect even the smallest change, whether it was intentional (by a malicious attacker, for example) or accidental (as when a file gets corrupted). When a code signature is intact, the system can be sure the code is as the signer intended. Identify code as coming from a specific source (a developer or signer).  The code signature includes cryptographic information that unambiguously points to a particular author. Determine whether code is trustworthy for a specific purpose.  Among other things, a developer can use a code signature to s
Post a Comment
Read more

How to find firmware or boot ROM version in Mac OS X

Firmware and boot ROM version of your mac can be found in two ways. Way 1 : 1. From "Apple" menu , choose "About This Mac" menu item. 2. Click " More Info " to open "System Profiler" application. 3. Under Contents -> Select Hardware Tree item. On the right side panel Under hardware overview section, we can see Boot ROM Version and SMC (Firmware) Version. Way 2 : Run the below command in terminal to get boot ROM version and SMC(firmware) version : $ system_profiler SPHardwareDataType | grep -i "Version" | awk -F ':' '{print $1 $2}'
6 comments
Read more

How to get a certificate fingerprint as SHA-256, SHA-1 or MD5 using OpenSSL on mac

As per my old post ( http://anandmpandit.blogspot.in/2016/11/how-to-extract-signing-certificates.html ) , we can extract the binary signing certificates on mac using codesign tool. If you needed to get fingerprint details of the certificate in MD5, SHA1 or SHA256 format then you have run below steps on the extracted certificate file on macOS. SHA256: SHA256 Fingerprint=D3:0A:32:6C:77:77:93:B5:45:20:AC:C0:D4:7E:3A:84:34:50:96:54:08:7F:7D:63:4C:3E:06:3B:E8:1F:C1:90 SHA1: SHA1 Fingerprint=BF:2C:93:1F:BD:88:E5:4C:96:D8:86:D5:F1:E6:9B:B7:DE:76:51:62 MD5: MD5 Fingerprint=3C:A3:3B:76:6D:AE:3F:4B:4E:B2:AA:66:97:55:B8:76
Post a Comment
Read more