Hi all,
yesterday I updated my iMac OS to the latest version and noticed accidentally, while I was searching for other settings, that I could “Turn on” my FileVault.
This was shocking, as I turned on my FileVault ever since I bought the iMac! Does any of you have any idea how this could have happened? Furthermore, is there any way I can trace when this might happened?
Thank you, and let me wish the community here a fantastic New Year!
iMac
Thank you HWtech, I noticed you’re referring to my laptop, but it’s about our Intel based iMac, with 27” screen.
I remember, when I bought the iMac with Catalina as OS on it, I restricted booting from USB. But, I have no clue when my FileVault was set to off.
This is very good advice, locking the firmware(if it’s not too late), because exactly this had happened to my router, the firmware was manipulated.
I will put it into practice, thanks!
Let me wish you a fantastic new year!
Thank you HWtech, I noticed you’re referring to my laptop, but it’s about our Intel based iMac, with 27” screen.
I remember, when I bought the iMac with Catalina as OS on it, I restricted booting from USB. But, I have no clue when my FileVault was set to off.
This is very good advice, locking the firmware(if it’s not too late), because exactly this had happened to my router, the firmware was manipulated.
I will put it into practice, thanks!
Let me wish you a fantastic new year!
I've seen in other discussions that when you upgrade from one macOS to a new macOS, that Apple disables FileVault in order to perform the upgrade. This seems to have started in the newer versions since Monterey. To verify you might want to contact Apple Support though.
Considering the threat of your neighbor, you can enable a firmware lock on the laptop which will prevent anyone from being able to boot from an external drive or attempting to access the internal drive through Target Disk Mode as a firmware password is needed to access Recovery Mode and Target Disk Mode, as well as Option Booting. This does prevent you from performing a PRAM Reset and automatically booting to an external drive yourself. When a firmware lock is enabled, some Apple startup keys won't even prompt you for the firmware password and will just automatically skip into booting to the internal drive which can be annoying since at first you think you didn't press the startup keys correctly.
You definitely want to make sure never to forget the firmware password, otherwise you will need to provide Apple or an AASP with acceptable proof of purchase (only available if you are the original owner of the Mac) and acceptable ID. Otherwise you will only be able to boot into the OS on the internal boot drive. FYI, a firmware lock is not available for Apple Silicon Macs, although with Apple Silicon Macs, there may be ways to use 2FA/MFA for the macOS login...not really an easy option for an Intel Mac due to the limited nature of the Intel UEFI firmware.
Set a firmware password on your Mac - Apple Support
Unfortunately you are unlikely to be able to search the history of the system for any information. The macOS system logs are a complete mess these days and are not an option for troubleshooting anymore. In fact those logs will even scare you that something bad is going on as the system logs can contain entries that are scary sounding, when in fact there is nothing abnormal going on.
Unfortunately not, it’s an Intel based, bought just before Apple came with the T2.
I had a chat with Apple Support and it didn’t clear my concerns.
Apple is not ruling out any of these: upgrade/user switched off/third-party application.
The only thing I can rule out is that non of the iMac users switched off FileVault.
Is there any check you can recommend that I can do, before wiping everything off and reinstall?
We have a psychopath neighbour who broke into our appartment multiple times and already manipulated my company laptop(bitlocker encrypted) and my router.
The iMac was locked and had three profiles, one with admin rights, and two regular users.
Thank you Randall for your prompt reply! I will contact Apple support, just to rule out anything else happened to my system.
I wish you a good start into 2023!
Is it a T2 Mac or an Apple Silicon Mac? Those are always encrypted regardless of FileVault.
Enabling and disabling FileVault just shifts responsibility for the keys to the users.
FileVault turned off
