Enter the master password to unlock the startup disk.Replace 'name' with the name of the startup volume, and replace /path with the path to FileVaultMaster.keychain on the external drive or disk image:ĭiskutil ap unlockVolume 'name' -recoveryKeychain /pathĮxample for a startup volume named Macintosh HD and a recovery-key volume named ThumbDrive:ĭiskutil ap unlockVolume 'Macintosh HD' -recoveryKeychain /Volumes/ThumbDrive/FileVaultMaster.keychain Open Terminal, then enter the following command to unlock the encrypted startup disk.You will need this information in the next step. If you don't know the name of the startup volume (such as Macintosh HD) on the disk you want to unlock, open Disk Utility, then locate the volume name in the sidebar.If you stored the private recovery key in an encrypted disk image, double-click the file to mount the image and enter the password when prompted.On the host Mac, connect the external drive that contains the private recovery key.When you're prompted to enter a password to unlock the disk, click Cancel.Connect the Mac to another Mac (the host) using a Thunderbolt 3 (USB-C) cable.Once you see the Thunderbolt logo, release the T key.On the Mac you want to unlock, turn on the computer while holding the T key.If a user forgets their macOS user account password and can't log in to their Mac, you can use the private key to unlock their disk. You should see a message that a recovery key has been set by your company, school, or organization. If FileVault is turned off, open Security & Privacy preferences and turn on FileVault.Sudo fdesetup changerecovery -institutional -keychain /Library/Keychains/FileVaultMaster.keychain If FileVault is already turned on, enter this command in Terminal:.Sudo chmod 644 /Library/Keychains/FileVaultMaster.keychain Sudo chown root:wheel /Library/Keychains/FileVaultMaster.keychain These commands make sure that the file's permissions are set to -rw-r-r- and the file is owned by root and assigned to the group named wheel. Open the Terminal app and enter both of the following commands.Put a copy of the updated FileVaultMaster.keychain file in the /Library/Keychains/ folder.After removing the private key from the keychain, follow these steps on each Intel-based Mac that you want to be able to unlock with your private key.

How get recovery key for mac filevault