4 disks called "Creedence Cryptex" appeared on my desktop

It seems that at about macOS Sequoia 15.1.1 and later external boot volumes might get the following disk image which annoyingly "litters" the Disk Utility list when booted to such volume (in the screenshot below the Mac was booted from an external macOS 15.2 volume that lists a snapshot):

Creedence11M6270.SECUREPKITRUSTSTOREASSETS_SECUREPKITRUSTSTORE_Cryptex

That .dmg is at (visible or in some setups invisible):

/System/Library/AssetsV2/com_apple_MobileAsset_PKITrustStore/purpose_auto/6dd55b0d06633a00de6f57ccb910a66a5ba2409a.asset/AssetData/Restore/SECUREPKITRUSTSTOREASSETS_SECUREPKITRUSTSTORE_Cryptex.dmg

It seems for some users that .dmg is somehow auto-mounted to the Desktop, sometimes multiple times. But I have not seen that behavior.

That .dmg seems to need more than 'sudo rm' if the user wants to delete it.

For example in my setup (Mac mini 2018 Intel, macOS 15.2, Carbon Copy Cloner 7.0.4):

The internal macOS 15.2 volume that is updated incrementally at every step from a cleanly installed 15.0 to 15.2 does not have that folder or .dmg. But if I use CCC 7.0.4 to make a bootable clone from it to an external volume, boot to it, then that folder and .dmg is somehow generated and visible in Disk Utility list.

On the other hand, if I use CCC to clone an existing old macOS 15.1 bootable clone disk image to a "real" volume, and boot it, then that enclosing folder and .dmg does not exist. But after updating that volume to macOS 15.2 it is generated.

Silicon Macs use the internal disk also for the initial boot sequence to external disks so maybe it is related to this issue also on Intel Macs?

I have decided to ignore this cosmetic issue.

They are part of the operating system. You won't be able to delete them. You can try dragging the desktop disk imager to the Trash. Hopefully that will unmount it.

I don't know why they are showing up on your desktop. The most likely explanation is some kind of 3rd party system modification app. Such things are extremely popular and extremely problematic.

Whoever is reading, I have already provided the steps to fix it above.

The issue is certain legacy apps are causing it. So each person's use case will be different, start by turning off ALL the launchdaemons and reboot. You'll notice there won't be any cryptex disks on the desktop after a reboot.

This is a method of troubleshooting and to find the culprit.

In our customers case the reason was an old version of bitdefender...

I wrote:

So far I have spotted these .dmg files generated only on external drives in Sequoia 15.1.1 or later.

I now see that .dmg also on Sequoia 15.2 internal disk at:

/System/Library/AssetsV2/com_apple_MobileAsset_PKITrustStore/purpose_auto/6dd55b0d06633a00de6f57ccb910a66a5ba2409a.asset/AssetData/Restore/SECUREPKITRUSTSTOREASSETS_SECUREPKITRUSTSTORE_Cryptex.dmg

I swear it did not exist there a few months ago although it and its enclosing and subfolders, and other files there have date 19. Sep 2024. Previously those items were only present on external Sequoia boot volumes.

The remaining difference to external boot volumes is that Disk Utility does not show that .dmg as an unmounted volume at the bottom of its list on the left when booted to the internal volume while when booted to an external volume it is listed there (it has never auto-mounted for me when booted to the external volume).

I have decided to ignore that gremlin. I guess it is just some new part of macOS security chain and updates.

patrickfrompaducah wrote:

The function of it is to allow Apple to update parts of the MacOS without a full update. It creates these secure partitions on any drive that you boot from or contains one of these areas of the OS, regardless of internal or external.

Thanks for the info. So far I have spotted these .dmg files generated only on external drives in Sequoia 15.1.1 or later.

Maybe they are related to Rapid Security Responses (RSRs)?

Rapid Security Responses on Apple devices - Apple Support

No, Creedence is not spying. Follow where it is mounted and you can see that the contents is a PKI trust store (in my case dated from last July). Reasonable that this should be a cryptex as it ensures 1) that we can't modify the trust store and 2) macOS can update it without a macOS version update.

One of our customers has this issue too, currently in the process of troubleshooting it and so far managed to get rid of the dmg from mounting. Now in the process of figuring out what the source is.

I recommend using this process to figure out which app(s) is/are causing this

Go to your login items (launch daemons) and literally turn off everything that has a slider in the list and once you've done that reboot your Mac. You'll notice that it won't come up anymore.

After that try turning on a handfull of startup apps every time to narrow down which app(s) are causing this to come up.

This will help you find out the reason, since only 1 person is affected from our customer I have asked that person to perform these steps as he's a local admin on his Mac.

I installed the macOS on an external hard drive and have two user accounts. After logging into one of the accounts, a disk icon labeled “Creedence11M6270.SECUREPKITRUSTSTOREASSETS_SECUREPKITRUSTSTORE_Cryptex” appeared on the desktop and could not be deleted. The solution is simple: log out of your iCloud account, restart the system, and then log back into your iCloud account.

The function of it is to allow Apple to update parts of the MacOS without a full update. It creates these secure partitions on any drive that you boot from or contains one of these areas of the OS, regardless of internal or external.

So I had one Creedence .dmg file in my disk utility window-IT SHOULD not be there. I started up with an external drive and made all the files visible on the boot drive and external drive there by seeing the invisible Creedence .dmg in the AssetsV2 folder. I deleted the Creedence .dmg from there.

I figured if it already installed what it needed to install- no need for the .dmg file and it seemed to me as an errant remnant file. Made all the files visible again and restarted from boot drive. Everything is fine and no Creedence image file in disk utility. How and why it appeared, I have no idea. Maybe from a failed start up from an old copy of Ventura on an external drive, possibly!

I mentioned this on 1/24/25

So I had one Creedence .dmg file in my disk utility window-IT SHOULD not be there. I started up with an external drive and made all the files visible on the boot drive and external drive there by seeing the invisible Creedence .dmg in the AssetsV2 folder. I deleted the Creedence .dmg from there.

I figured if it already installed what it needed to install- no need for the .dmg file and it seemed to me as an errant remnant file. Made all the files visible again and restarted from boot drive. Everything is fine and no Creedence image file in disk utility. How and why it appeared, I have no idea. Maybe from a failed start up from an old copy of Ventura on an external drive, possibly!

I mentioned this on 1/24/25

So I had one Creedence .dmg file in my disk utility window-IT SHOULD not be there. I started up with an external drive and made all the files visible on the boot drive and external drive there by seeing the invisible Creedence .dmg in the AssetsV2 folder. I deleted the Creedence .dmg from there.

I figured if it already installed what it needed to install- no need for the .dmg file and it seemed to me as an errant remnant file. Made all the files visible again and restarted from boot drive. Everything is fine and no Creedence image file in disk utility. How and why it appeared, I have no idea. Maybe from a failed start up from an old copy of Ventura on an external drive, possibly!

I have an external TB enclosure and running on the same Mac Mini 2018, this seems to be an issue when you are logged into iCloud, as when I Switch Users on my Mac with a user that is not logged into iCloud this does not appear on the desktop, only appears on the desktop when I log in with the User that is logged into iCloud.

Nope. Sorry, ichibanmugen,—I did this and that did not work.

All are off, disk STILL shows.

I may have discovered the complete resolution: You will need two External drives ( one of the backup and the other that you ultimately want to boot from as your daily driver).

1. Create a backup
2. Then from the Mac you want to run Sequoia from an external TB or USB enclosure, Boot into Internet Recovery mode Command + R upon start up
3. Open Disc Utility
4. Select the the External drive that you want to boot from with Sequoia and format it
5. Right Click on this newly formatted drive and Choose Restore
6. You will have options to select from Discs, choose the External drive that you performed the backup to
7. Once Restore has completed, select the Restored Volumes and provide a Unique name
8. Quit out of Disc Utility
9. Then Select Re-Install Sequoia
10. After successful upgrade to Sequoia your External drive is now ready for one last step
11. Open Settings and select Privacy & Security/Local Networks
12. Turn off any previous Applications that are trying to find and communicate with devices on your local network.