How to cope with a FileVault recovery key disappearing while you write it down – Macworld

How to cope with a FileVault recovery key disappearing while you write it down | Macworld ');consent.ads.queue.push(function(){ try { IDG.GPT.addDisplayedAd("gpt-superstitial", "true"); $('#gpt-superstitial').responsiveAd({screenSize:'971 1115', scriptTags: []}); IDG.GPT.log("Creating ad: gpt-superstitial [971 1115]"); }catch (exception) {console.log("Error with IDG.GPT: " + exception);} }); The key cant be re-displayed once its dismissed.

Today's Best Tech Deals

Picked by Macworld's Editors

Top Deals On Great Products

Picked by Techconnect's Editors

FileVault is an extraordinary bit of macOS technology. Introduced years ago, it encrypts the entire contents of your startup volume so that when the data is at restwhen your Mac is powered downthe drive is effectively full of garbage nonsense to anyone who doesnt possess either the password to an account authorized to log in via FileVault or the special recovery key set when you turn FileVault on.

When you use the Security & Privacy preference panes FileVault tab to enable this encryption, macOS prompts you with two choices:

In both cases, a recovery key is set. However, if you use iCloud to store your key, you never see it, and Apple manages the recovery process. All you need is your iCloud password and, if you turned on two-factor authentication, a trusted device or access to a trusted phone number. But this introduces risk, as someone who obtained your computer and discovered your password could potentially unlock the drive, too.

I prefer the second choice, as it provides entirely local control. No secret is stored remotely. You only face a problem if you forget the passwords to all macOS accounts approved for FileVault-based cold start (from a shutdown state) loginsand you lose your recovery key. (I have heard of cases in which account information becomes corrupted, though, and the recovery key is the only way to start up a Mac.)

What happens if, while youre trying to write down the recovery key, it disappears from the screen? While this seems unlikely it happened to one reader, who doesnt believe they clicked a button or otherwise caused the key message to dismiss. They wrote in to ask how they could recover the recovery key?

Unfortunately, theres no method to retrieve the key once its been displayed and dismissed. The recovery key is generated and passed through a strong one-way encryption process; only the result is used to further protect the keys used in FileVault encryption. The recovery key is displayed once. When you dismiss the dialog, macOS tosses this original version of it forever. (Entering the precise original recovery key, which is fed through the same one-way process, unlocks the data that it protects.)

If you werent able to write the key down before it disappeared from view, you have to disable FileVault encryption and re-enable it to generate a new recovery key:

In the Security & Privacy system preference pane, click the FileVault tab.

Click the lock icon at the lower-left corner and enter an account name and password with administrative access.

Click the Turn Off FileVault button.

Confirm you want to disable FileVault by clicking Restart & Turn Off Encryption.

Your Mac now restarts. After you log back in using an account with FileVault permission, macOS begins decrypting the entire contents of the drive. This can take quite a while.

When decryption is complete, you can return to the FileVault tab and click Turn On FileVault.

At the Recovery Key prompt, choose the Create a recovery key option and write the key down. You might even quickly take a picture of it as a backup. (But be sure to delete that photo and then permanently delete it from the Recently Deleted album to avoid any chance of someone gaining access to it.)

Restart again and FileVault begins the slow process of encrypting the startup volume once more.

This Mac 911 article is in response to a question submitted by Macworld reader Michael.

Weve compiled a list of the questions we get asked most frequently along with answers and links to columns: read our super FAQ to see if your question is covered. If not, were always looking for new problems to solve! Email yours to mac911@macworld.com including screen captures as appropriate, and whether you want your full name used. Not every question will be answered, we dont reply to email, and we cannot provide direct troubleshooting advice.

More:
How to cope with a FileVault recovery key disappearing while you write it down - Macworld