Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to change the apple on the FileVault login screen to something else. I've searched Google, but none of the links I've found have worked. They all suggest changing one or more of the following, none of which seems to work:

  • /System/Library/Frameworks/AppKit.framework/Versions/C/Resources/NSTexturedFullScreenBackgroundColor.png
  • /System/Library/PrivateFrameworks/LoginUIKit.framework/Versions/Current/Frameworks/LoginUICore.framework/Resources/apple.png
  • /System/Library/PrivateFrameworks/LoginUIKit.framework/Versions/Current/Frameworks/LoginUICore.framework/Resources/appleLinen.png

I've changed those, but the apple remains on the FileVault login screen. As Daniel Beck points out, that's because those files are on the encrypted disk, and thus couldn't possibly be what FileVault is using to show the login screen.

share|improve this question
Changing that last image worked for me. I opened it in Preview, flipped it horizontally, saved it on the Desktop, and replaced that file using my version from the command line. Now I have a left-facing Apple. – Daniel Beck Nov 29 '11 at 22:46
Please explain what exactly you are referring to: The Login Window (where you're entering your password), the Boot Image (when nothing else but the Apple is displayed), or maybe even the EFI-based Login Window for File Vault 2? – Daniel Beck Nov 29 '11 at 22:48
I can't get a screenshot, but I suspect it's the file vault screen. It's a solid grey screen with an apple of a different grey. – James A. Rosen Nov 29 '11 at 23:07
@dan there is indeed. And the background is definitely NOT patterned as I see in many screenshots. – James A. Rosen Nov 29 '11 at 23:37
Great point on the encrypted data problem. When I first asked the question, I didn't realize I was looking at the FileVault screen. – James A. Rosen Nov 30 '11 at 17:59

Since the hard drive is encrypted, the login screen cannot show these files directly before you unlock the drive by logging in. If you activate File Vault, certain resources, like the Apple icon, are placed on the Recovery HD partition for presenting them.

These resources are recreated every time you change a setting affecting the boot login screen, e.g.

  • System Preferences » Users & Groups » Login Options » Display login window as…
  • System Preferences » Security & Privacy » Disable restarting to Safari when screen is logged (i.e. "Safari guest account")

Change the files you know already to the desired resource, and toggle one of these options to recreate the resources on your boot disk.

You can test correct presentation by activating Fast user switching menu in Login Options of Users & Groups preference pane, and selecting Login Window… from the new menu item.

Alternatively, you can edit the /System/Library/Caches/ file in the Recovery HD partition's rock-paper-scissors folder manually using the information in this topic. The Apple icon is the entry named loginui_apple.png.

Be aware that your changes will be overridden whenever you change a relevant setting in System Preferences.

share|improve this answer

BootXChanger might be what you need. It has instructions on the download page.

BootXChanger will allow you to change the boot image and background colour on Mac OS X 10.4, 10.5 and 10.6

To set an image as a boot image, open BootXChanger and drag it to the image well, and click Apply. You can also click the background colour to change it. You will then be asked for an administrator password, as the boot image is stored in a system file.

enter image description here

share|improve this answer
Sadly, it doesn't seem to support Lion. – James A. Rosen Nov 29 '11 at 22:49

When you have trouble getting it onto the Recovery partition, you can just use the workaround identified in this blog post:

share|improve this answer
Can you please provide a context for that link? This helps future readers if that blog post were to become unavailable. – Moses Sep 11 '13 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .