Hacker News Reader

Comment by Aqua_Geek | Hacker News Reader

It does provide you with a recovery key, but that recovery key is useless if the file containing the volume master key is lost or corrupted (as happened here). In FileVault the recovery key is to protect you from losing your password, not from the system nuking the master key.

View on HN

Ah, that's my misunderstanding then. I always thought the recovery key was the volume master key, for the purposes of guarding against accidents like this. Good to know that's not the case; I think I should go check up on my backup solution now.

You can generate a new recovery key anytime once the volume is decrypted/booted:

    sudo fdesetup validaterecovery  # check
    sudo fdesetup changerecovery -personal  # change

Obviously this doesn't reencrypt the disk, so you can guess how it works.

Reply on news.ycombinator.com