Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have a folder containing files including Wills, Trusts, personal financial statements etc. Most of these files are word docs, excel spreadsheets, PDF's and jpegs. I would like to protect this folder from prying eyes.

If this info was housed in a .dmg, it would seem pretty straightforward to click on the .dmg, enter my password, mount the drive, access the information/folder and when finished, eject the disk image knowing it is closed and protected.

Am I missing something? Any pros/cons of this idea?

share|improve this question
2  
As you might need these files even when your Mac breaks, keep in mind that DMG files are conveniently read on Mac machines, but not so easily on Windows PC's. If you need the files fast and have no access to Mac you might have trouble accessing them on a Windows machine. –  Bart Arondson Feb 6 '13 at 15:59
add comment

5 Answers

Your use case is exactly why encrypted DMG were created. The external file name can be different than the actual name of the filesystem can be obfuscated while the drive is not mounted.

The only con (which kind of is a Pro) is that spotlight can't search within an unmounted image and you may want to disable spotlight entirely on that volume just in case you don't want any extra caches / extra access that isn't necessary.

Alternatives to this is storing text in a keychain secure note, especially if you keep alternate keychains for more secure information. I also find myself storing more things in 1Password when I don't need a self-contained archive for things like certain client data or certain data I wish to be doubly encrypted. (I use FileVault on most Mac these days so that everything is encrypted at least once.)

share|improve this answer
    
Thank you for your prompt reply. When you say "you may want to disable spotlight entirely on that volume", I assume you mean by dragging the Disc Image Icon or adding it to the privacy part of the Spotlight preferences. Is that correct? I tried to drag/add the actual .dmg file, but it's grey-out and can not be added. Thanks again, FH –  Frank Hayek Feb 5 '13 at 21:50
2  
A quick way to do that is to run this terminal command while your disk is mounted: touch /Volumes/NameOfYourDMGVolume/.metadata_never_index. That will create an empty file that Spotlight will see and know not to index the volume. –  JRobert Feb 5 '13 at 21:57
    
BTW, this works with any other volume; putting a .metadata_never_index file in the root of e.g., an external HDD or flash drive, works to prevent it being indexed as well. –  JRobert Feb 5 '13 at 22:18
    
Yes - there are several ways a file or directory can be excluded and I usually drag items into the preference pane as you described. The hidden file is slick, but I don't trust myself to notice when something hidden disappears should that file get deleted. I use the . file for when I want to stop indexing a new drive temporarily, so it's very useful nonetheless. –  bmike Feb 5 '13 at 22:41
add comment

Like the other guys said, dmg is probably the best way to keep important folders encrypted. However, you should keep in mind the following:

  1. When you create a dmg file, you must specify its size. Once done, it will have that size no matter what you delete from it. Also, you will not be able to add anything in dmg further to that size. There is a way to resize dmg, like any other partition, you can do it from Disk Utility. So in terms of size, it's not optimal per se.
  2. If you want a "flexible" encrypted file, you should use sparse image or sparse bundle image. The first is one large file, the second is a collection of small files (which can be handy). Both types require that you define maximum size, but will physically take as much space as you really put into them. However, as far as I know, if you delete things, they won't shrink - there is a manual way to shrink them from Terminal.

One thing important to me (may or may not be to you): dmg files, even encrypted with 256 AES, can be open in Windows, using appropriate apps. To me, this means I don't depend on Mac, even if I lose it, I can still access backed up dmg files from any machine (any means Windows, over 90% out there are, like it or not). However, sparse and sparse bundle files can't be accessed from Windows, so you're stuck with Macs. To me, this is a dealbreaker for sparse stuff.

share|improve this answer
1  
How do you access a .dmg file on Windows - let alone an encrpted one –  Mark Nov 4 '13 at 23:45
1  
There is a Question about that on SuperUser : superuser.com/questions/42338/… –  Matthieu Riegler Nov 5 '13 at 0:04
    
Yup, there it is. I contacted the DMGExtractor staff and they answered positively: it CAN open even the 256-bit encrypted DMGs. However I haven't yet tried it myself, so I can't speak from experience. –  Martin Nov 14 '13 at 22:41
add comment

TrueCrypt is an open source utility (Mac, Windows, Linux) that can encrypt and decrypt a group of files into a archive. It is multiplatform, fast and portable. You can also add a hidden partition that is not visible if you need a second layer of security. I recommend taking a look at this.

http://www.truecrypt.org

share|improve this answer
add comment

Using a disk image .dmg to hold your private documents is an ideal use of disk images. Apple provide detailed steps for setting up such a disk image, how to create a password-protected (encrypted) disk image.

Applications > Utilities > Disk Utility.app

Use the Disk Utility application to create a sparse bundle disk image with 256-bit AES encryption. These two settings ensure you have a secure container that can grow to accommodate more files in the future.

You should select a suitably large initial size, such as 8 GB or more. The initial disk image will not be 8 GB but will be able to to grow as you add files.

You should disable Spotlight indexing on your secure volume by creating a .metadata_never_index file. You can do this through the Terminal.app:

  1. Mount your secure disk image;
  2. Launch Terminal.app;
  3. Change in your secure volume's root directory: cd /Volumes/<secure volume name>
  4. Create the invisible never index file: touch .metadata_never_index

New Image settings in Disk Utility on Mac OS X 10.8

share|improve this answer
add comment

I have to add my two bits here about password strength. As I stated before any encrypted volume will only be as secure as the password you are using.

The real issue is how strong the password for the encrypted volume is. If the password is not a random string of characters, but based on a dictionary word with substitutions of 1 for i etc, the files while encrypted might as well not be.

Ensure your password is based on a long sentence where you use all punctuation marks, include spaces, numbers and special characters.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.