File Vault prevents repair of HD with Disk Utility

[Rod]

This is really starting to bug me. I have a client who ran Disk Utility on Verify HD. She is running Yosemite 10.10.2 on a mid 2013 MacBook Pro. Disk Utility suggested she needed to repair her HD and the "restart holding Command + R" message. She did that and when she went to repair the HD the repair option was not available (greyed out).
I repeated the process with the same result. But I noted that the volume was encrypted.
Apple says, "To mount, verify, or repair a drive or volume that is encrypted with FileVault using Disk Utility, enter the FileVault password when prompted." I'm not sure how old that info is but at no time were we prompted to enter a password.
So having a full recent TM backup I suggested she unencrypt the HD using FV and we could go from there.
The thing is like other clients I have had who upgraded to Yosemite she did not realise that she had chosen to encrypt her HD in the first place, or rather that she had not chosen not to.
This has become a reoccurring theme and it concerns me that this unencryption process must be performed on a corrupted HD.
Hopefully all will be fine if not a clean reinstall and restore from TM will probably work but this is where I'm unclear.
Assuming the TM backup is also encrypted she will end up with an encrypted HD like it or not.
I suppose we could unencrypt after that but it suggests that Apple would prefer us to have encrypted HD's so what is the point of Disk Utility being unable to repair it? I assume it is because the recovery partition is not encrypted that the problem occurs.
So we are now waiting the estimated 6 hrs for unencryption. I will see how that goes and get back to this post.
Any comments or faults in my reasoning or method would be gratefully received.
Rod

 

[chas_m]

Reason #27 not to use Filevault.

 

[Rod]

Oh my god, you mean there are 26 others?

 

[chas_m]

Many more than that, really -- but the primary one is that if you lose/forget the password, or the encrypted HD gets corrupted -- goodbye data FOREVER.

There's just no good reason to use whole-disk software encryption unless perhaps you're working for a spy agency. Too many risks to justify the "security."

 

[Rod]

chas-m that is exactly my worry. I have to wait 6 hrs to find out if the unencryption process works. The reason for using the restore partition in the first place was because of corruption. The most likely reason anyone would. If Disk Utility can't be set up to repair encrypted HD's it kind of defeats the point.
Apple seems to say it can be done but that was a little outdated referring to Mavericks and before.
I am not a spy!

 

[Rod]

Well, I have to report good news. The HD was successfully decrypted, HD repaired using Disk Utility, permissions repaired and client (not to mention myself) much relieved.
It's not hard to see why even after some research people might think File Vault is a good idea with articles like this out there. How to encrypt your Mac with FileVault 2, and why you absolutely should | Macworld

 

[harryb2448]

The Warnings! need to be bigger and in CAPITALS.

Dangerous FV as folk consistently forget or lose the password, which is pretty complicated to start with.

Probably vital for 007 and KGB operatives.

 

[Rod]

I can only assume that Apple (and others) think that turning FV off is just a simple matter of clicking a box. No one mentions how long it may take to unencrypt ie. a 500Gb HHD with only 200Gb of storage took 6 hrs.
Initially it estimated 15 hrs.
This apparent paranoia coupled with the industry enthusiasm for better and better security is frustrating to say the least. I'm sure the exponents of encryption are not the same people who have to repair the problems created by it.
One thing I didn't know (actually theres a lot of things I don't know) were the FileVault 2 Pre-Boot Recovery Options described in this article;
https://derflounder.wordpress.com/2015/01/17/yosemites-filevault-2-pre-boot-recovery-options/
These instructions provide for three scenarios and by far the best one is; "The I forgot my password option is most useful to folks who had chosen the option when enabling FileVault 2 to use their Apple ID to unlock the disk and reset your password'.
Not so good if you didn't so why not suggest it at the start? eg It is suggested you use your Apple ID to unlock FV in case you lose/forget your password.

 

[Rod]

And if you thought that might be a bit complicated for the average OP (especially the one that didn't even know thier HD was encrypted) have a gander at this; https://derflounder.wordpress.com/2...lete-while-booted-from-yosemites-recovery-hd/
Oh, and the comments posted at the bottom of this article are case in point. That from someone who sounds like they have some prior understanding.

 

[Rod]

And this is the really bad news; Can FileVault be bypassed with OS X password reset routines? - CNET

 

[chscag]

And this is the really bad news; Can FileVault be bypassed with OS X password reset routines? - CNET

Why is it bad news? Seems to me it's good news for those who really need to protect sensitive data on their Mac knowing that FileVault can not be bypassed. For others, the simple solution is if you don't have the need for file encryption, then don't use it.

 

[Rod]

Yes, it means that Apple's FV is 100% unbreakable. Good news for those who deliberately initiated it, received their Recovery key, wrote it and their FV password on a piece of paper and placed it in a safe easily accessible place. Or if they were lucky enough to decide to use their Apple ID as a password. The last person I asked who did that said yes I have it in my wall safe at home. Home being in Holland, she was in Bali at the time.
It all worked out for my client because she could still boot her HD and was able to use her admin password to unlock FV, thus decrypt the HD successfully.
Had she been unable to boot the Macintosh HD she would have been in trouble I think.
The point of all this is my original argument; why should an inexperienced OP have to decide not to encrypt at upgrade when they may have no knowledge of the implications?

 

[pm-r]

Well, I have to report good news. The HD was successfully decrypted, HD repaired using Disk Utility, permissions repaired and client (not to mention myself) much relieved.
It's not hard to see why even after some research people might think File Vault is a good idea with articles like this out there. How to encrypt your Mac with FileVault 2, and why you absolutely should | Macworld

I'll bet that if Chris Breen was still with Macworld, that article would never have been published.

 

[chscag]

I'll bet that if Chris Breen was still with Macworld, that article would never have been published.

LOL, Chris Breen left MacWorld to work for Apple! How about that for a bit of irony?

 

[pm-r]

LOL, Chris Breen left MacWorld to work for Apple! How about that for a bit of irony?

Actually, Apple hired him to get some guidance and working sensibility back into their systems and products I hear.

Just the same as he would have done with that article if he had still been at Macworld, and I'll bet he wouldn't even have allowed it to be published:
How to encrypt your Mac with FileVault 2, and why you absolutely should | Macworld

He's more for supporting the average user, not the exceptional use user.