FileVault password file may be corrupted???

edptb2014

I have a macbook pro running 10.6.8.  When I set it up, I enabled FileVault (version 1) and saved the password.  My system crashed the other day and now when I log in, it tells me that my user account password is different from my FileVault password, but I did not change any password -- it's the same one I used to set up the system.  It is prompting me to enter my "old user account password".  I do not have an 'OLD' password as it's the same one I've always had.  I think perhaps that when the system crashed, the FileVault password file got corrupted which is why the passwords no longer match.

I have a root user account set up and have tried a bunch of different things to get this restored, including two visits to my local Apple store (Genius Bar) but no luck.  I am always prompted for a "master password" but the one I set up does not work.

I have tried restoring system files (e.g., /Library/Keychains) from my Time Machine backups but that hasn't worked.

At this point, I fear I've lost everything on this disk but I figured I'd reach out in case anyone may know of a way around this.

Thanks in advance.

-Ed

marvin

If you can login as root, can you try to mount the disk image using the terminal:

hdiutil attach -autofsck /Users/username/username.sparsebundle

Replace username with your actual home folder name. FileVault 1 sparse images can get corrupted during a system crash so it is possible that it won't be mountable.

edptb2014

Thanks for replying Marvin.  After entering that command, I am prompted for a password.  Neither the user password nor the Master password work here.

The question I have is, if the sparse.bundle got corrupted, could it prevent me from ever entering a password that it will accept?

Thanks again!

marvin

edptb2014 wrote: »

Thanks for replying Marvin.  After entering that command, I am prompted for a password.  Neither the user password nor the Master password work here.
The question I have is, if the sparse.bundle got corrupted, could it prevent me from ever entering a password that it will accept?

If the image was corrupted, it would most likely say it wasn't accessible. Your password and master key don't encrypt the image directly as this would require decrypting and encrypting on changing the password. They are used as key encryption keys and unlock the key that is used to encrypt the volume originally. This is how multiple keys can unlock the same volume. It's possible that your keychain might have been affected preventing your passwords from unlocking the volume key but even if that was the case, your user account should still let you login. If you type the following in the terminal:

su username

substituting 'username' for your own home folder name, it will prompt you for a password to login. On entering your password, if it doesn't give an error and allows you to login then that is the right password for that account. If it says "sorry", then for whatever reason, that password is no longer the password on that account.

There's an app called Keychain Access in /Applications/Utilities. It has a first aid option in one of the menus. That will run through and verify all the keychains.