Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to do remote checks to verify OSX has filevault enabled. When you enable filevault, does it create / change something on the HDD that I can check for on VPN login using my posture assessment tools?

share|improve this question
Are you using only the command line or can you view GUI? Assuming VPN login allows you to view GUI you can just go to Disk Utilities > Select HDD Partition > If it's encrypted it should say at the bottom Format : Encrypted Logical Partition – Hengjie Nov 8 '12 at 10:06
Hi only command line. We dont trust the users :). – Rob Veiga Nov 8 '12 at 14:49

Can you run a command line tool, such as fdesetup?

$ sudo fdesetup status
FileVault is On.

fdesetup also accepts the verb isactive, which returns 0 if FileVault is enabled (checking a return value is arguably more reliable than reading the text):

$ sudo fdesetup isactive
$ echo $?

fdesetup does require root access, which might be a problem.

You could also run diskutil cs list and check for the encryption status. The exact wording you're looking for is a bit complicated because of all the different possible combinations, this script might be a good start.

share|improve this answer
many thanks ill try one of theose – Rob Veiga Nov 9 '12 at 9:22
Hi, another question. Does enabling filevault create a file somewhere on the file system that would not exist when filevault is disabled? – Rob Veiga Nov 12 '12 at 11:06
Not that I know of. If you want to check, you could do a backup with Time Machine, enable/disable FileVault, and then use tmutil compare to see if any relevant-looking files have changed. But there's nothing I'm aware of. – gabedwrds Nov 12 '12 at 14:50

The rtrouton script mentioned previously seems needlessly complicated (I ended up there first, but after reading half of it came here). I'm probably going to start with the below and wrap a little more logic around it.

diskutil cs list | grep "Fully Secure"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.