diskutil is still missing a way to decrypot a drive using an institutional recovery keychain. It looks like the command wil be added later.
Old method:
diskutil cs revert xxxxxxxx-
xxxx
-xxxx-xxxx-xxxxxxxxxxxx -recoveryKeychain /Volumes/Untitled/FileVaultMaster.keychain
Assumed new:
diskutil APFS decryptVolume
xxxxxxxx-
xxxx
-xxxx-xxxx-xxxxxxxxxxxx -recoveryKeychain /Volumes/Untitled/FileVaultMaster.keychain
As of 10.13.3 beta there is no -recoverykeychain in the decryptvolume action. Is this planned> Is there a work around?
unlockVolume | unlock volumeDevice [-user disk | -user
cryptoUserUUID | -recoverykeychain file]
[-passphrase passphrase] | [-stdinpassphrase]
[-nomount | -mountpoint mountpoint] [-verify]
[-plist]
decryptVolume volumeDevice [-user disk |
existingCryptoUserUUID] [-passphrase
existingPassphrase | -stdinpassphrase]