Summer is at an end, and I feel like I have missed it entirely. This technician has only seen a few glimpses of sun in between hours spent repairing computers.
One bit of information that I have come across lately is that one has ability to unlock a FileVault 2 encrypted computer and decrypt it as long the administrator password is known, as that is the account that manages FileVault security. This will only work with FileVault 2; legacy FileVault encrypts the whole drive and won’t allow you to even reformat the hard drive. Legacy encrypts the entire drive where FileVault 2 will give you the option to encrypt the partition or the user.
To start this process, you will need to boot into the recovery partition, CMD+R on start up just after hitting the power button. Once you see the Apple logo and the spinning wheel, you can let go. You will be prompted for a language; select yours and continue. Next you will be presented with a list, which you’ll ignore; select Utilities from the menu, then select Terminal.
For you power users, this is your command line interface, all text based. First input:
*diskutil corestorage list*
This will list any volumes that have been encrypted by FileVault 2. Pay attention — you need the UUID for the FileVaulted volume. It will be something like “Logical Volume C464C2C0-74BF-4C63-B469-23D8ED0034FF”; it won’t be identical or even close when it comes to the string of numbers and letters but that’s the important part that you need.
Next, we need to unlock the volume so we can encrypt it next. Type in:
*diskutil corestorage unlockVolume “UUID” -stdinpassphrase*
Replace “UUID” with your specific UUID number without quotes. Make sure you pay attention to the spaces as these are important. Next it will prompt you for the passphrase or password of the administrator account that has access to the FileVault settings. This password should be different than the actual FileVault password. You should see that the volume is unlocked with the password accepted, and that it finished its corestorage operation and is ready for input. (If you get an error, you know that you tried the wrong password.)
Now it’s time to decrypt the volume; this can take time, depending on the volume size. Type in:
*diskutil corestorage revert “UUID” -stdinpassphrase*
Replace the “UUID” with your specific UUID without the quotes, and again, it will ask you for the password. Input the admin password and hit Enter. Decryption will begin, but it won’t display anything; type in:
*diskutil corestorage list*
This will display its progress at the time of the inquiry. Once the operation is complete, you should be able to quit Terminal, open Disk Utility from the same menu, and the drive and partition will be listed (so long as the partition says Macintosh HD — or whatever you named it — and not ‘Incompatible Format’). Then, you have successfully removed the FileVault 2 encryption from your hard drive.
Restart the machine and allow it to boot normally. It should now bypass the FileVault password request and go right to your login screen.
Success!
