Unlock or decrypt your FileVault 2-encrypted boot drive from the command line

In addition to using Disk Utility, you can also use the command line to unlock or decrypt a FileVault 2-encrypted drive. In order to make sure it all works, I recommend that you use the Recovery HD partition or the Recovery HD partition cloned onto an external drive. See below the jump for the procedure.

---

Update – June 11, 2013: As of Mac OS X 10.8.4, you will need to unlock the encrypted volume first, then you will be able to decrypt it. See this post for details.

---

---

Update – April 27, 2014: If you are working with a Fusion Drive, do not use the decryption instructions included with this post. See this post for how to unlock or decrypt a Fusion drive.

---

---

Update – August 11, 2014: Problems have been found when decrypting from Mavericks’ Recovery HD. See this post for a description of the problem and available workarounds.

---

To start with, you will need to identify the Logical Volume UUID of the encrypted drive using the diskutil corestorage list command:


diskutil corestorage list


Running that command will give you a listing of all Core Storage volumes. To help identify what you’re looking for, I’ve highlighted the UUID of the encrypted drive in this example:

Once you have the UUID, you can then either unlock or unencrypt the encrypted volume using the following commands.

Using the password of an authorized account on the command line

To unlock: diskutil corestorage unlockVolume UUID -stdinpassphrase

The -stdinpassphrase flag will cause the command to prompt you for the password/passphrase of an account that’s authorized to unlock the encryption.

If successful, the drive will unlock and mount. You should see output similar to that shown below.

Once you’ve unlocked the disk, you can then revert it back from being an encrypted volume.

To decrypt: diskutil corestorage revert UUID -stdinpassphrase

You’ll be prompted for the password/passphrase of an account that’s authorized to unlock the encryption. Once provided, decryption of the encrypted volume will begin.

To track its progress, you can use the diskutil corestorage list command. To help identify the decryption status, I’ve highlighted the relevant sections to check in the list.

Once the drive has been completely decrypted, it will no longer be listed as a CoreStorage volume by diskutil corestorage list. In Disk Utility, it should appear as a normal hard drive.

Using the FileVault 2-generated individual recovery key on the command line

If you don’t have the password of any of the authorized accounts and you are not using an institutional recovery key with FileVaultMaster.keychain, you can use the FileVault 2-generated individual recovery key instead. The commands are mostly the same, but instead of using the -stdinpassphrase flag, you instead use -passphrase and enter the recovery key.

To unlock: diskutil corestorage unlockVolume UUID -passphrase recoverykey

If successful, the drive will unlock and mount. You should see output similar to that shown below.

Once you’ve unlocked the drive, you should also be able to unencrypt it using this command: diskutil corestorage revert UUID -passphrase recoverykey

Using FileVaultMaster.keychain on the command line

At this time, it’s only possible to unlock or decrypt from the command line if you’re using a institutional recovery key that’s been set with FileVaultMaster.keychain. Here’s how you can unlock the encryption using an institutional recovery key with FileVaultMaster.keychain:

1. Copy your FileVaultMaster recovery keychain from the safe place your institution stored it in to a drive that you can access from Recovery HD.

2. Boot to the Recovery HD partition or the Recovery HD partition cloned onto an external drive.

3. Get the Logical Volume UUID of the encrypted drive by running diskutil corestorage list.

4. With the UUID information acquired, run the following command to unlock the FileVaultMaster.keychain:

security unlock-keychain /path/to/FileVaultMaster.keychain

Once this command is run, you’ll need to enter your institution’s Master Password when prompted. If the password is accepted, you’ll be taken to the next prompt.

5. Run the following command to unlock the encrypted Core Storage volume on the encrypted Mac:

diskutil corestorage unlockVolume UUID -recoveryKeychain /path/to/FileVaultMaster.keychain

6. You should then see output similar to the following:


Started CoreStorage operation
Logical Volume successfully unlocked
Logical Volume successfully attached as disk4
Logical Volume successfully mounted as /Volumes/Macintosh HD
Core Storage disk: disk4


At this point, with the disk unlocked and mounted, you should be able to recover your data using whatever tools you prefer.

Once you’ve unlocked the disk, you can also then decrypt the encrypted volume by running the following command:

diskutil corestorage revert UUID -recoveryKeychain /path/to/FileVaultMaster.keychain

Once it’s decrypted, you should have full access to your hard disk’s data.