Do when macOS does not boot an APFS volume anymore and I cannot unlock it

apfsboothard drivemojave

I have an SSD, which until this morning I booted from through an usb3-to-sata adapter. I shut the computer off, removed the drive and came back to the Macbook hanging on a black screen when trying to boot from it.

I have tried with both MacBook Pro 15-inch 2018 and a Mid-2012 13" model. They behave similarly in that nothing happens after pressing ALT during boot and selecting the volume. Both Macbooks have macOS Mojave on them.

Things I've tried

1

Booting a different volume and trying to mount the offending disk (e.g. via disk utility), this window appears:

enter image description here

But it does not allow me to actually enter a password.

2

I have also tried the following form the terminal:

diskutil apfs unlockVolume /dev/disk3s1

This prompts for the password, but fails with

Passphrase incorrect or user does not exist

although the passphrase is correct.

3

I then ran diskutil apfs listcryptousers /dev/disk3s1 and got this list:

Cryptographic user for disk3s1 (1 found)
|
+-- EBC6C064-0000-11AA-AA11-00306543ECAC
    Type: Personal Recovery User

Not sure what this means, but I used the UUID to unlock the volume, to no avail:

$> diskutil apfs unlockVolume /dev/disk3s1 -user EBC6C064-0000-11AA-AA11-00306543ECA
Passphrase:
Unlocking the specific cryptographic user EBC6C064-0000-11AA-AA11-00306543ECA on APFS Volume disk3s1
Error unlocking APFS Volume: Malformed UUID (-69578)

At this point, I guess I have to erase the drive and restore it from backup, but macos recovery does not allow me to erase it without unlocking it. Seems to me I'm trapped by buggy software.
What can I do here? (even if it involves erasing the disk in question)?

Best Answer

Regarding the first attempt to simply use unlockVolume, please consider trying this variation instead:

diskutil apfs unlockVolume /dev/disk3s1 -user disk

Your attempt to unlock using the UUID failed, because you failed to enter the complete UUID. I don't know if you typed it in manually or used cut-n-paste, but you've missed the last letter "C" in the UUID - making it one character short.

I would try that command again with the full UUID - and remember that you're not supposed to enter your passphrase for the drive to unlock it with that UUID - instead you need to enter the personal recovery key. The personal recovery key was presented to you when you first enabled FileVault (I assume this drive was previously a boot drive) - and it takes the form of 24 upper cases alpha-numeric characters, grouped in 4 seperated by dashes. Something like AB1C-DEF2-G3HI-4JKL-MNO5-PQRS.

If the above fails, you can always erase everything on the drive completely, as you indicate this would be an acceptable option.

You can do that by opening Terminal.app and running the following command:

dd if=/dev/zero of=/dev/rdisk3 bs=1m

After it has finished, reboot the system so that it forgets the old partitioning information. Then you can use Disk Utility to add a partition table and format the drive.