It’s not often I get to play with Macbooks these days. Today we had an interesting situation where a user had passed away and of course nobody knows what password was used on their account and it was the only account on the machine. But it had data on it that needed to be recovered (and of course the drive was also encrypted as well to make matters worse). In linux we would typically just go to single user mode and type passwd user account and be done with it.. In OSX you can to some extent do this in the case that the drive is NOT encrypted (just run an fsck on the disk then mount -uw / and you should be able to alter the password). In any case here is how I did it.
- Reboot and hold the “command” + “s” keys to boot into single user mode
- Mount the disk
- Delete the applesetupdone file – What this does is tricks the OS into thinking its new out of the box and it needs to go through its setup process again.
- Reboot the machine by typing “reboot” followed by the return key
Now you should be at a setup screen. Click through the prompts and when it asks about transfering data BE SURE TO CLICK “DO NOT TRANSFER MY DATA“. Don’t worry the original data is still there.
- Connect to your wifi if you care to through the setup
- Create a new account (this will be a new administrator account on the machine but the old one will still be there as well)
- Finish setup and login to the machine with your new admin account.
- Open System Preferences from the apple menu and then click Users & Groups
- Click the little lock at the bottom left screen and enter in the password you created earlier for your now account
- Select the user name of the original admin account and click “reset password” on the right
- Type in the new password and repeat it in the “verify” box and click “change password”
- You can now login as the original admin account with the new password you specified in the step above.