How to fix failed stashed KEK on boot?

Question

norlin-ru Author

Level 1

15 points

How to fix failed stashed KEK on boot?

Hey,

Suddenly my macbook stopped to boot, stuck on the Apple's logo and nothing happens.

macbook pro 13" retina with touch bar

macOS High Sierra (10.13.3)

- Safe mode and Single user mode does not make any difference.

- Recovery mode is working, macOS reinstall didn't helped.

- Verbose mode shows a log for a split second and then the logo appears.

I have managed to take a photo of the log, it says it can't find the FileVault key to unlock my system volume.

The issue is – it does not ask me for the password! Just stuck on the logo screen...

Any ideas how to fix this issue? I perfectly know the FileVault password, how can I restore the "stashed KEK"? Or how to reset it completely to force the boot sequence to ask me for the password?

Here is the photo of the log, sorry for the bad focus – I was failed to take a better picture (this log is displayed just for a single moment)

Posted on Mar 2, 2018 12:08 PM

Reply

Answer 1

norlin-ru Author

Level 1

15 points

Mar 2, 2018 11:34 PM in response to Encryptor5000

I have tried to do this way, but when I'm entering teh password to disable the FileVault – it ask me if I'm sure and then says "Incorrect password". (Password is correct – I can use it to mount the volume in Disk Utility).

Also, if I'm entering a wrong password – it says "Incorrect password" immediately, without confirmation.

Here is the log from Terminal:

Reply

Answer 2

norlin-ru Author

Level 1

15 points

Mar 3, 2018 7:22 AM in response to Encryptor5000

When I'm mounting the Volume via the Disk Utility in the Recovery mode – it succesfully mounted with my password and I can access my files via Terminal.

But in the Password Reset assistent it says "Incorrect password" (while the password is correct) and I see the error (I've aded the screenshot above) in the Terminal.

Solution: Anyway, I have performed the clean re-install (erased the whole volume and restored everything from the Time Machine backup). It's faster then continue to look for a fix... After clean re-install the issue is gone, yet I did not enabled FileVault again, maybe will try it later.

p.s. I'm not sure but I think the Preboot volume was corrupted with 10.13.2 -> 10.13.3 update

Reply

Answer 3

Mar 3, 2018 7:22 AM in response to norlin-ru

Hi Norlin,

Thank you for the detailed information - much appreciated!

From what I can tell, your Mac is failing to boot the Preboot volume containing the FileVault login window. Disabling FileVault would fix this issue (it should be safe to turn it back on after this).

Boot macOS Recovery and open Terminal. Execute resetpassword to bring up the Password Reset Assistant. Choose My keyboard isn’t working when typing my password. Enter your login password to disable FileVault and start the decryption process. If all goes well, the assistant should say that your startup disk was successfully decrypted and give you a restart button. Restart your Mac and it should boot macOS and bring up the login window. Log in as normal.

In order to finish decryption of your SSD, you’ll need to plug your MacBook into power. Decryption status is shown in the FileVault pane of Security and Privacy Preferences. Once decryption is finished, open Terminal and execute this command:

diskutil list

Verify that a volume named Preboot is listed, then turn FileVault back on if desired.

Hope this helps!

Reply

Answer 4

norlin-ru Author

Level 1

15 points

Mar 2, 2018 9:46 PM in response to Encryptor5000

Thank you for the advice, just the decryption & encryption took a huge amount of time, probably it would be faster to perform a clean install & recovery from a backup…

Is there any way to restore the Preboot volume unlick key, or reset it to force the system ask the password on boot?

Reply

Answer 5

Mar 3, 2018 6:34 AM in response to norlin-ru

Sorry, but I’m confused. Were you able to successfully decrypt your Mac or did an error occur in Password Reset Assistant?

Reply

How to fix failed stashed KEK on boot?

Similar questions