I encrypted my internal hard drive with FileVault a while ago on Lion such that it prompts for the disk password when I restart the computer and recently upgraded to Mavericks on my MBPro Retina. It was a variation of one of my old passwords and I can't remember it after I hadn't restarted in probably a month, so basically I am stuck at the login screen.

I got ahold of a copy of Passware and was able to mount the Recovery HD in Recovery Mode from the hard drive, obtaining the wipekey file in order to brute force the password on a separate computer, but apparently I also need to obtain a copy of the encrypted volume image. Using Terminal the only thing I was able to mount was the EFI partition and I tried running Passware with the EFI partition image and separately with the Recovery HD partition image but neither ended up working (Passware gave me errors) so I think I need an image of the entire volume. I would like to try the Firewire physical memory method but it still requires the same image of the encrypted volume. Diskutility was useless in trying to mount any of the drives since it is greyed out and requires me to unlock it before doing anything else.

When I open Terminal in Recovery Mode and use

diskutil mountDisk disk0 it only mounts the EFI partition and not the whole disk. And if I try to just mount the main encrypted partition of the drive it says mounting failed. As a side, I do have the administrator password for my computer but the password doesn't work when trying to reset the FileVault password in Terminal. Is there a way for me to obtain an image of the drive and copy it to an external hard drive without going through DiskUtility since I can't mount the drive? Again the only tools I can use are in Recovery Mode.

I have already resigned myself to having to reformat since I have been overdue for one, but any help would be greatly appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.