Babgond

As part of a recent discussion in the Mac Admins Slack, it was asked if it was possible to validate a FileVault personal recovery key (PRK) without having to interactively enter it. Normally, to validate a PRK using the fdesetup command line tool, you would use the following command:

You’ll then be prompted to enter the PRK. This is an alphanumeric string separated by dashes, which should look similar to what’s shown below:

XGRX-W8ZG-747N-KWQT-CQAV-FC49

The output of running the command should look similar to what’s shown below. If the PRK is valid, the command should return a value of true.

If not, the command will return a value of false.

This method assumes you can interactively enter the PRK information. If an interactive entry of the PRK information is not an option for some reason, the validaterecovery function includes an -inputplist option. This allows the PRK information to be stored in a plist file and be read from that file. For more details, please see below the jump.

In this scenario, you would create a plist file formatted like the one shown below:

Once you have the plist file created and stored in a location you can access, you can then run the following command to validate the recovery key using the information stored in the plist file:

Assuming that the PRK was XGRX-W8ZG-747N-KWQT-CQAV-FC49 and stored in a file named recoverykey.plist located in the /Users/Shared directory, the recoverykey.plist file’s contents would look like this:

You could then run the following command to validate the PRK using the recoverykey.plist file stored in the /Users/Shared directory:

If the PRK stored in the plist file is the current valid PRK, you should get a value of true.

Otherwise, you will get a value of false.