In Disk Utility suddenly are 7 Disk Images with strange names. They start with Creedence or Revival and all end with _Cryptex.

[Adora]

Hi,

does anyone know, where those could come from. They were suddenly there a few days ago.

I can't eject them and when I click on "Mount" at the greyed out disk just nothing happens.

The last thing I remember doing before they suddenly were there, was installing the Pro Apps of Apple after they got an update. Logic (including many additional stuff), Final Cut, Motion, Compressor and also Main Stage and I reactivated some login items from apps that were already installed, that I deactivated now again and rebooted, but it didn't help.

Others things I did was uninstalling many apps I don't need.

I changed to an external drive as my boot drive lately, but that didn't cause this. At least they appeared later.

There is only Clearwater missing, to have the Band "Creedence Clearwater Revival" at the beginning.

It's an iMac M3 with macOS 15.2 Beta.

I found a thread here about this where someone had something similar caused by an app I never heard of and he just needed to update it. In the Apple forums there were also a few people having this on and it was recommended to just disable all login items, but not more info what exactly is causing this. Someone had it only on his intel Mac and not on his M2.

Very strange... Maybe I forgot something I did. that could cause this. Disconnecting external drives also doesn't help. At the moment there is only the boot drive and a TimeMachine drive connected. I have a few additional backup drives, that I now only connect when needed.

 

[Bigwaff]

… after restart they remain?

 

[jdb8167]

Hi,

does anyone know, where those could come from. They were suddenly there a few days ago.

View attachment 2453323

I can't eject them and when I click on "Mount" at the greyed out disk just nothing happens.

View attachment 2453333

The last thing I remember doing before they suddenly were there, was installing the Pro Apps of Apple after they got an update. Logic (including many additional stuff), Final Cut, Motion, Compressor and also Main Stage and I reactivated some login items from apps that were already installed, that I deactivated now again and rebooted, but it didn't help.

Others things I did was uninstalling many apps I don't need.

I changed to an external drive as my boot drive lately, but that didn't cause this. At least they appeared later.

There is only Clearwater missing, to have the Band "Creedence Clearwater Revival" at the beginning.

It's an iMac M3 with macOS 15.2 Beta.

I found a thread here about this where someone had something similar caused by an app I never heard of and he just needed to update it. In the Apple forums there were also a few people having this on and it was recommended to just disable all login items, but not more info what exactly is causing this. Someone had it only on his intel Mac and not on his M2.

Very strange... Maybe I forgot something I did. that could cause this. Disconnecting external drives also doesn't help. At the moment there is only the boot drive and a TimeMachine drive connected. I have a few additional backup drives, that I now only connect when needed.

You can read this article (at EclecticLight.co) for more information. Those are likely just being used as a beta test.

 

[Adora]

… after restart they remain?

Yes. I think there was even a Beta update in the meantime and they remained

You can read this article (at EclecticLight.co) for more information. Those are likely just being used as a beta test.

Thanks. I'll have a look at that.

 

[Adora]

You can read this article (at EclecticLight.co) for more information. Those are likely just being used as a beta test.

I didn't really understand everything, but interesting.

That website is great anyway. I recently found many good apps there.

The strange thing is I was in Disk Utility almost every day this year, because I had to test many external drive/backup solutions and see those for the first time now. I was on macOS 15 Developer Beta from day one.

At least I know I can just ignore them and maybe they just go away with the next update. At first I thought it could be malware because of those strange names at the beginning.

And I'll have a look in Tinker Tool System if it somewhere has information on those. I already did, but was too tired then.

I had a full installer for 15.2 Beta 3 and used it for the external drive, so they didn't come directly with the update and there wasn't one after that.

 

[gilby101]

Hi,

does anyone know, where those could come from. They were suddenly there a few days ago.

I can't eject them and when I click on "Mount" at the greyed out disk just nothing happens.

I am jealous. I only have the Creedence cryptex. Intel macOS 15.1 with no betas.

I know cryptexes have been around for a while, but I don't understand why they are now being mounted like this in Sequoia when they weren't under Sonoma, etc.

… after restart they remain?

My single cryptex does.

I will update to 15.1.1 later today and see if that changes things.

 

[Adora]

I am jealous. I only have the Creedence cryptex. Intel macOS 15.1 with no betas.

I know cryptexes have been around for a while, but I don't understand why they are now being mounted like this in Sequoia when they weren't under Sonoma, etc.


My single cryptex does.

I will update to 15.1.1 later today and see if that changes things.

Is it still there? Maybe you get some more with 15.2.

I wonder why none of mine is starting with Clearwater.

All are still there but I didn't get an update yesterday.

 

[gilby101]

Update to 15.1.1 made no difference.

This question is being asked here https://apple.stackexchange.com/que...kitruststoreassets-securepkitruststore-crypte where I have comments with:

"Cryptexes are used to store cryptographically signed code in addition to that in the macOS system volume. For an extensive discussion of cryptexes see this by Howard Oakley.

There are discussions of this particular cryptex issue on the web, e.g. Four Creedence Cryptexes on desktop.

This claims to include a fix, but I am not convinced Fix: Disks Called Creedence Cryptex Appear on Mac Desktop.

But there is some suggestion that one (or more) cyptexes are visibly mounted due to interaction with either VPN or A-V software. I have not investigated this, but likely starts by booting in Safe Mode."

So I am sure that the next step towards a diagnosis is to start in Safe Mode and see if the cryptexes are still mounted.

ps: Some say plural is cryptices, but I think the majority say cryptexes.

 

[Adora]

Update to 15.1.1 made no difference.

This question is being asked here https://apple.stackexchange.com/que...kitruststoreassets-securepkitruststore-crypte where I have comments with:

"Cryptexes are used to store cryptographically signed code in addition to that in the macOS system volume. For an extensive discussion of cryptexes see this by Howard Oakley.

There are discussions of this particular cryptex issue on the web, e.g. Four Creedence Cryptexes on desktop.

This claims to include a fix, but I am not convinced Fix: Disks Called Creedence Cryptex Appear on Mac Desktop.

But there is some suggestion that one (or more) cyptexes are visibly mounted due to interaction with either VPN or A-V software. I have not investigated this, but likely starts by booting in Safe Mode."

So I am sure that the next step towards a diagnosis is to start in Safe Mode and see if the cryptexes are still mounted.

ps: Some say plural is cryptices, but I think the majority say cryptexes.

I updated to Beta 4 of 15.2 and they all are also still there. I'll have a look at your links later, thanks.

 

[gilby101]

Please can those who see this strange behaviour say what Mac they are using and where mounted. I am wondering if it is hardware dependent, particularly what security chip (or none) is in the Mac.

My case: iMac 2019, one instance of Creedence cryptex in Disk Utility. Mounted inside folder /System/Library/AssetsV2/com_apple_MobileAsset_PKITrustStore/purpose_auto/6dd55b0d06633a00de6f57ccb910a66a5ba2409a.asset where you can see its content.

 

[Adora]

I have an M3 iMac.

I also have that folder it only includes a 3 byte xml file.


But I just saw there is a folder called Cryptexex in the System Folder that lead me to

/System/Yolumes/Preboot/Cryptexex/App

what includes things like Password Managers from Mozilla, Chrome, Apple and many Safari stuff, even the Safari app itself. It's all created on the same day and time.

Here is all what it includes:

The Content of the OS folders looks like a macOS installer.

 

[gilby101]

But I just saw there is a folder called Cryptexex in the System Folder that lead me to

/System/Yolumes/Preboot/Cryptexex/App

Yes, that is what I see. /System/Volumes/Preboot/Cryptexes/ is where I expect to see cryptexes. That is contained in the Preboot volume. These are all dated in November which is what we might expect.

The files in the Creedence cryptex are dated 2-July-2024. Maybe that is the last time the list of PKI certificates was modified. All very strange.

I have an M3 iMac.

Bang goes my theory that this might be only for Intel, because the Intel Macs (particularly the 2019 iMac) do not have a secure store for boot code.

… after restart they remain?

You can read this article (at EclecticLight.co) for more information.

I take it that neither of you see the Creedence or Revival cryptexes in Disk Utility.

But, I would like to know if you do have Creedence mounted at /System/Library/AssetsV2/com_apple_MobileAsset_PKITrustStore/purpose_auto/6dd55b0d06633a00de6f57ccb910a66a5ba2409a.asset and (in Finder) can see that there is PKI certificate stuff inside.

If you have it mounted, then the oddity is just that it appears in Disk Utility for a few people.

If you don't have it mounted, then it is much odder and needs more thorough investigation.

 

[Adora]

Yes, that is what I see. /System/Volumes/Preboot/Cryptexes/ is where I expect to see cryptexes. That is contained in the Preboot volume. These are all dated in November which is what we might expect.

The files in the Creedence cryptex are dated 2-July-2024. Maybe that is the last time the list of PKI certificates was modified. All very strange.


Bang goes my theory that this might be only for Intel, because the Intel Macs (particularly the 2019 iMac) do not have a secure store for boot code.



I take it that neither of you see the Creedence or Revival cryptexes in Disk Utility.

But, I would like to know if you do have Creedence mounted at /System/Library/AssetsV2/com_apple_MobileAsset_PKITrustStore/purpose_auto/6dd55b0d06633a00de6f57ccb910a66a5ba2409a.asset and (in Finder) can see that there is PKI certificate stuff inside.

If you have it mounted, then the oddity is just that it appears in Disk Utility for a few people.

If you don't have it mounted, then it is much odder and needs more thorough investigation.

That's exactly the first one I can see in DiskUtility.

When I open it there are those files:

 

[Adora]

I did this and it directly came back after a second.

 

[Adora]

The other ones are also in subfolders of System/Library/AssetsV2.

Do you know what this UAF is?

At first I didn't know I can just click "Show in Finder" in Disk Utility to find them. And searched for half an hour without finding anything. 🙈

 

[Adora]

I just found out, it was the date (November 16th) when all those main folders were created was the day when I installed macOS on an external drive and transferred all my data to it, to use it as my main boot drive.

But there were no Cryptexes in DiskUtility after doing that.

Before that I saw a thread here, that Apple Intelligence (what I normally have disabled) doesn't work on external drives and someone posted a Terminal command to make it work and I tried that just to confirm:

curl -L https://raw.githubusercontent.com/Kyle-Ye/XcodeLLMEligible/release/0.2/scripts/override.sh | bash -s -- install override xcodellm+greymatter+strontium

Intelligence works since then, but I have disabled it again.

Could it be this caused those Crypexes to be mounted? But they have an older date. It's only the main System folders date from that day, because they were migrated then.

 

[gilby101]

Intelligence works since then, but I have disabled it again.

AI is not available for most (non US English speakers). So I think it is unlikely that there is a direct relationship.

 

[Adora]

@gilby101


Three disappeared now without doing anything special. Or doing anything at all because I had to sleep very much. I only logged in to the root account to change the icon of my startup disk yersterday or so.
And I uninstalled IINA Player today because it suddenly didn't work anymore a few hours ago and rebooting didn't help. It's still not working. Just jumping in the Dock. I used it every day and didn't change anything.

Some strange things are going on with on iCloud-Drive hosted files. Those are MP3 files in a folder on my Desktop and it's only a part of it. Not all did get that strange "Date Added", whatever that means, maybe from the first Unix version or so... I didn't change anything in that folder. Just played a few of the files:

At least iCloud Drive for me always just works instead of Proton Drive that is only doing strange things.

 

[gilby101]

As an update, I have at last (!!) got round to starting in Safe mode. The Creedence cryptex is still mounted. Makes me think it is not an interaction with non-Apple software (system/network extensions) but really is a bug in macOS. For me, it is a minor (but perplexing) annoyance that I can live with for now.

 

[Patrice Brousseau]

Here a discussion, where I posted, about that strange Cryptex volumes: https://discussions.apple.com/thread/255784972?answerId=260892032022&sortBy=rank#260892032022

I have only one in Sequoia 15.1.1 in Disk Utility and fortunately, it doesn’t show on the desktop unlike the OP in the aforementioned Apple forums thread.

MacMini late 2018 BTW.

 

[Patrice Brousseau]

I just found out, it was the date (November 16th) when all those main folders were created was the day when I installed macOS on an external drive and transferred all my data to it, to use it as my main boot drive.

But there were no Cryptexes in DiskUtility after doing that.

Before that I saw a thread here, that Apple Intelligence (what I normally have disabled) doesn't work on external drives and someone posted a Terminal command to make it work and I tried that just to confirm:

curl -L https://raw.githubusercontent.com/Kyle-Ye/XcodeLLMEligible/release/0.2/scripts/override.sh | bash -s -- install override xcodellm+greymatter+strontium

Intelligence works since then, but I have disabled it again.

Could it be this caused those Crypexes to be mounted? But they have an older date. It's only the main System folders date from that day, because they were migrated then.

On my MacMini, it’s there, booted on an external Thunderbolt test drive (Sequoia) but doesn’t show when booted from internal (Ventura). In the Apple forum thread I linked, one of the participants said that a complete reinstall cured it.

 

[Adora]

As an update, I have at last (!!) got round to starting in Safe mode. The Creedence cryptex is still mounted. Makes me think it is not an interaction with non-Apple software (system/network extensions) but really is a bug in macOS. For me, it is a minor (but perplexing) annoyance that I can live with for now.

Yes it's just a little annoying if you have many external drives and often use DiskUtility. I removed them all to test if it's coming from one of them, but seems to have nothing to do with the other drives.

I just see the three that were gone are back. Now there are again seven.

Here a discussion, where I posted, about that strange Cryptex volumes: https://discussions.apple.com/thread/255784972?answerId=260892032022&sortBy=rank#260892032022

I have only one in Sequoia 15.1.1 in Disk Utility and fortunately, it doesn’t show on the desktop unlike the OP in the aforementioned Apple forums thread.

MacMini late 2018 BTW.

That would be really annoying if they are all also on the Desktop.

On my MacMini, it’s there, booted on an external Thunderbolt test drive (Sequoia) but doesn’t show when booted from internal (Ventura). In the Apple forum thread I linked, one of the participants said that a complete reinstall cured it.

I could use the full installer und "update" again with it. Maybe that helps...

 

[Patrice Brousseau]

Yes it's just a little annoying if you have many external drives and often use DiskUtility. I removed them all to test if it's coming from one of them, but seems to have nothing to do with the other drives.

I just see the three that were gone are back. Now there are again seven.




That would be really annoying if they are all also on the Desktop.





I could use the full installer und "update" again with it. Maybe that helps...

I should say that I am a bit OCD most of the time. However, this "bug" doesn't affect the machine at all except this weird annoying "appearance" under Disk Utility. I've then decided to not bother at all...

I've tried a couple of thins mentioned in the Apple forum thread but it didn't disappeared. Next would be a full reinstall but it's not worth it, IMHO and in my particular situation (only one little 4 MB Cryptex volume).

***If you ever decide to reinstall, keep us informed

 

[JUMA55]

Yes it's just a little annoying if you have many external drives and often use DiskUtility. I removed them all to test if it's coming from one of them, but seems to have nothing to do with the other drives.

I just see the three that were gone are back. Now there are again seven.




That would be really annoying if they are all also on the Desktop.





I could use the full installer und "update" again with it. Maybe that helps...

Yesterday I reformatted, reinstalled Sequoia and restored from Time Machine, and the Creedence file is still there.

 

[Patrice Brousseau]

Yesterday I reformatted, reinstalled Sequoia and restored from Time Machine, and the Creedence file is still there.

Thanks for the report .