{"id":52,"date":"2025-01-15T23:37:05","date_gmt":"2025-01-15T12:37:05","guid":{"rendered":"https:\/\/www.dnssec.au\/?p=52"},"modified":"2025-02-09T01:15:21","modified_gmt":"2025-02-08T14:15:21","slug":"automount-external-encrypted-disk-on-macos-at-boot-before-login-screen","status":"publish","type":"post","link":"https:\/\/dnssec.au\/?p=52","title":{"rendered":"Automount external encrypted disk on MacOS at boot before login screen (edited for using . instead of \/)"},"content":{"rendered":"\r\n<p>I am using a mac mini with my home directory on an external ssd. This SSD is encrypted with FileVault and this prevented me from logging in since the disk would not be mounted at login time. <\/p>\r\n\r\n\r\n\r\n<p>This is how I solved this problem:<\/p>\r\n\r\n\r\n\r\n<ol class=\"wp-block-list\">\r\n<li>Determine you external disks UUID<br><\/li>\r\n<\/ol>\r\n\r\n\r\n\r\n<pre class=\"wp-block-code\"><code>ivar@minimac log % diskutil apfs list\r\nAPFS Containers (4 found)\r\n|\r\n+-- Container disk3 A4C78520-6C44-4369-B6D3-3BBEF8809024\r\n|   ====================================================\r\n|   APFS Container Reference:     disk3\r\n|   Size (Capacity Ceiling):      494384795648 B (494.4 GB)\r\n|   Capacity In Use By Volumes:   116917420032 B (116.9 GB) (23.6% used)\r\n|   Capacity Not Allocated:       377467375616 B (377.5 GB) (76.4% free)\r\n|   |\r\n|   +-&lt; Physical Store disk0s2 B6EC8D3A-80A2-4D51-B243-EC9531ACD609\r\n|   |   -----------------------------------------------------------\r\n|   |   APFS Physical Store Disk:   disk0s2\r\n|   |   Size:                       494384795648 B (494.4 GB)\r\n|   |\r\n|   +-> Volume disk3s1 000207E7-AA2F-4570-ADD6-08C03AEABFB3\r\n|   |   ---------------------------------------------------\r\n|   |   APFS Volume Disk (Role):   disk3s1 (System)\r\n|   |   Name:                      Macintosh HD (Case-insensitive)\r\n|   |   Mount Point:               Not Mounted\r\n|   |   Capacity Consumed:         11200786432 B (11.2 GB)\r\n|   |   Sealed:                    Yes\r\n|   |   FileVault:                 No (Encrypted at rest)\r\n|   |   |\r\n|   |   Snapshot:                  C4274A37-C0E5-4082-BE2E-8C9DC278EB08\r\n|   |   Snapshot Disk:             disk3s1s1\r\n|   |   Snapshot Mount Point:      \/\r\n|   |   Snapshot Sealed:           Yes\r\n|   |\r\n|   +-> Volume disk3s2 950C6069-EF3D-4FB7-BF96-7FF71F810152\r\n|   |   ---------------------------------------------------\r\n|   |   APFS Volume Disk (Role):   disk3s2 (Preboot)\r\n|   |   Name:                      Preboot (Case-insensitive)\r\n|   |   Mount Point:               \/System\/Volumes\/Preboot\r\n|   |   Capacity Consumed:         6923579392 B (6.9 GB)\r\n|   |   Sealed:                    No\r\n|   |   FileVault:                 No\r\n|   |\r\n|   +-> Volume disk3s3 0196D09E-CA05-4BB4-A628-02DD398E3BE6\r\n|   |   ---------------------------------------------------\r\n|   |   APFS Volume Disk (Role):   disk3s3 (Recovery)\r\n|   |   Name:                      Recovery (Case-insensitive)\r\n|   |   Mount Point:               \/Volumes\/Recovery\r\n|   |   Capacity Consumed:         1018593280 B (1.0 GB)\r\n|   |   Sealed:                    No\r\n|   |   FileVault:                 No\r\n|   |\r\n|   +-> Volume disk3s5 30F7C984-32CC-4C00-B212-7A8A0BD6B50D\r\n|   |   ---------------------------------------------------\r\n|   |   APFS Volume Disk (Role):   disk3s5 (Data)\r\n|   |   Name:                      Data (Case-insensitive)\r\n|   |   Mount Point:               \/System\/Volumes\/Data\r\n|   |   Capacity Consumed:         95464325120 B (95.5 GB)\r\n|   |   Sealed:                    No\r\n|   |   FileVault:                 No (Encrypted at rest)\r\n|   |\r\n|   +-> Volume disk3s6 257206F1-B5DE-478A-91C2-003D522BEBD9\r\n|       ---------------------------------------------------\r\n|       APFS Volume Disk (Role):   disk3s6 (VM)\r\n|       Name:                      VM (Case-insensitive)\r\n|       Mount Point:               \/System\/Volumes\/VM\r\n|       Capacity Consumed:         2147504128 B (2.1 GB)\r\n|       Sealed:                    No\r\n|       FileVault:                 No\r\n|\r\n+-- Container disk5 F65666AB-77A0-44CA-9573-B6377ECFDE76\r\n    ====================================================\r\n    APFS Container Reference:     disk5\r\n    Size (Capacity Ceiling):      4000577273856 B (4.0 TB)\r\n    Capacity In Use By Volumes:   633471152128 B (633.5 GB) (15.8% used)\r\n    Capacity Not Allocated:       3367106121728 B (3.4 TB) (84.2% free)\r\n    |\r\n    +-&lt; Physical Store disk4s2 E46170CF-E864-4262-A383-CE6A07DDA84F\r\n    |   -----------------------------------------------------------\r\n    |   APFS Physical Store Disk:   disk4s2\r\n    |   Size:                       4000577273856 B (4.0 TB)\r\n    |\r\n    +-> Volume disk5s1 <strong>D97312E1-CD94-478E-AF8F-50CA0E0FB1A9<\/strong>\r\n        ---------------------------------------------------\r\n        APFS Volume Disk (Role):   disk5s1 (No specific role)\r\n        Name:                      External (Case-insensitive)\r\n        Mount Point:               \/Volumes\/External\r\n        Capacity Consumed:         632985948160 B (633.0 GB)\r\n        Sealed:                    No\r\n        FileVault:                 Yes (Unlocked)\r\n<\/code><\/pre>\r\n\r\n\r\n\r\n<p>The uuid for my external disk is in bold above. Your UUID will not be the same. Write it down. You will need it for the automount script below.<\/p>\r\n\r\n\r\n\r\n<p>Then type sudo nano \/Library\/Scripts\/mountDisk.sh and paste in the following script taking care of changing the password for the encrypter disk to your password and the UUID to the UUID of your disk.<\/p>\r\n\r\n\r\n\r\n<pre class=\"wp-block-code\"><code>#!\/bin\/bash\r\n\r\n# Replace with your volume's UUID\r\nVOLUME_UUID=\"D97312E1-CD94-478E-AF8F-50CA0E0FB1A9\"\r\n\r\n# Function to mount the disk\r\n\r\nmountdisk() {\r\n    # Wait for the volume to come online\r\n    while :; do\r\n        echo \"Looking for disk...\"\r\n        \r\n        # Check if the volume with the specified UUID exists\r\n        diskutil apfs list | grep \"$VOLUME_UUID\" > \/dev\/null\r\n        \r\n        # If the volume is found, break the loop\r\n        if &#91; $? -eq 0 ]; then\r\n            echo \"Volume found.\"\r\n            break\r\n        fi\r\n\r\n        # If not found, wait for 1 second before retrying\r\n        echo \"Volume not found at $(date). Retrying in 1 second...\"\r\n        sleep 1\r\n    done\r\n\r\n    # Unlock and mount the encrypted disk\r\n    echo \"Unlocking and mounting the volume...\"\r\n    diskutil apfs unlockVolume \"$VOLUME_UUID\" -passphrase \"YourPasswordHere!\"\r\n}\r\n\r\n# Main script logic\r\nwhile :; do\r\n    # Start by waiting for and mounting the external drive\r\n    mountdisk\r\n\r\n    # Monitor the volume to ensure it remains mounted\r\n    while :; do\r\n        sleep 1\r\n\r\n        # Get the \"Mounted\" status of the volume\r\n        MOUNTED_STATUS=$(diskutil info \"$VOLUME_UUID\" | grep \"Mounted\" | awk '{print $2}')\r\n\r\n        # If the volume is still mounted, continue monitoring\r\n        if &#91;&#91; \"$MOUNTED_STATUS\" == \"Yes\" ]]; then\r\n            continue\r\n        else\r\n            # If the volume becomes unmounted, break the loop and attempt to remount\r\n            echo \"Disk has become unmounted. Attempting to remount...\"\r\n            break\r\n        fi\r\n    done\r\ndone<\/code><\/pre>\r\n\r\n\r\n\r\n<p>Once this script is saved we need to create the launchagent configuration file. run the command:<\/p>\r\n\r\n\r\n\r\n<p>sudo nano \/Library\/LaunchDaemons\/com.example\/mountDisk.plist<\/p>\r\n\r\n\r\n\r\n<pre class=\"wp-block-code\"><code>&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n&lt;!DOCTYPE plist PUBLIC \"-\/\/Apple\/\/DTD PLIST 1.0\/\/EN\" \"http:\/\/www.apple.com\/DTDs\/PropertyList-1.0.dtd\">\r\n&lt;plist version=\"1.0\">\r\n&lt;dict>\r\n    &lt;key>Label&lt;\/key>\r\n    &lt;string>com.example\/mountDisk&lt;\/string>\r\n    &lt;key>ProgramArguments&lt;\/key>\r\n    &lt;array>\r\n        &lt;string>\/bin\/bash&lt;\/string>\r\n        &lt;string>\/Library\/Scripts\/mountDisk.sh&lt;\/string>\r\n    &lt;\/array>\r\n    &lt;key>RunAtLoad&lt;\/key>\r\n    &lt;true\/>\r\n    &lt;key>StandardOutPath&lt;\/key>\r\n    &lt;string>\/var\/log\/mountDisk.log&lt;\/string>\r\n    &lt;key>StandardErrorPath&lt;\/key>\r\n    &lt;string>\/var\/log\/mountDisk.log&lt;\/string>\r\n    &lt;key>KeepAlive&lt;\/key>\r\n    &lt;true\/>\r\n&lt;\/dict>\r\n&lt;\/plist>\r\n<\/code><\/pre>\r\n\r\n\r\n\r\n<p>At this point if the disk is mounted log in as a user with a home directory on the internal drive that has admin rights. Make sure to log out as yourself first. This should unmount the external disk. Then run the following command as the internal admin user:<\/p>\r\n\r\n\r\n\r\n<pre class=\"wp-block-code\"><code>chmod ug=rx,o= \/Library\/Scripts\/mountDisk.sh\r\nsudo \/Library\/Scripts\/mountDisk.sh<\/code><\/pre>\r\n\r\n\r\n\r\n<p>This should run the script and it should say that it found the disk and mount it. Then it will just sit there waiting for the disk to be unmounted. When that happens it will remount it and wait again until its unmounted. This will repeat endlessly.  You can use control+c to interrupt the script. <\/p>\r\n\r\n\r\n\r\n<p>Once it works fine then it is time to add the service to the system so the disk gets mounted automatically at boot. Use this command to do this:<\/p>\r\n\r\n\r\n\r\n<pre class=\"wp-block-code\"><code>sudo launchctl load  \/Library\/LaunchDaemons\/com.example\/mountDisk.plist<\/code><\/pre>\r\n\r\n\r\n\r\n<p>Then reboot the host. Once it gets back to the login screen you should now be able to log in as the user with its home directory on the external drive.<\/p>\r\n\r\n\r\n\r\n<p>This also works if you enable autologin. <\/p>\r\n\r\n\r\n\r\n<p><\/p>\r\n\r\n\r\n\r\n<p>Have fun with this and spend the $$ yuou save on not buying apples expensive storage upgrades wisely.<\/p>\r\n","protected":false},"excerpt":{"rendered":"<p>I am using a mac mini with my home directory on an external ssd. This SSD is encrypted with FileVault and this prevented me from logging in since the disk would not be mounted at login time. This is how I solved this problem: The uuid for my external disk is in bold above. Your&hellip; <a class=\"more-link\" href=\"https:\/\/dnssec.au\/?p=52\">Continue reading <span class=\"screen-reader-text\">Automount external encrypted disk on MacOS at boot before login screen (edited for using . instead of \/)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-52","post","type-post","status-publish","format-standard","hentry","category-macos","entry"],"_links":{"self":[{"href":"https:\/\/dnssec.au\/index.php?rest_route=\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dnssec.au\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dnssec.au\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dnssec.au\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dnssec.au\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=52"}],"version-history":[{"count":4,"href":"https:\/\/dnssec.au\/index.php?rest_route=\/wp\/v2\/posts\/52\/revisions"}],"predecessor-version":[{"id":57,"href":"https:\/\/dnssec.au\/index.php?rest_route=\/wp\/v2\/posts\/52\/revisions\/57"}],"wp:attachment":[{"href":"https:\/\/dnssec.au\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dnssec.au\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dnssec.au\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}