Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

At work, I said to my colleague that it was not possible to enable Filevault on a RAID volume. He was surprised and asked me the technical reason.

So I would like to know. It's strange because Filevault is at the software level while RAID is at the hardware level.

share|improve this question
    
You are talking about a RAID volume created by Disk Utility here I assume? –  patrix Feb 8 '13 at 22:05
    
@patrix Yes, for example, 2 internal HDD set in RAID-1 in a Mac Mini. –  Benoit Feb 9 '13 at 8:58
add comment

2 Answers

up vote 2 down vote accepted

Both use the same data structure to create a volume within a volume.

One creates a wrapper and the data that is on the disk is scrambled / mapped through a cryptographic function so that the same data written to two different blocks ends up physically different on the drive. That's FileVault 2.

The other creates a wrapper and the data on the disk is either mirrored elsewhere or mapped through a splitting or shared checksum function so that the data on the drive is physically part of a check sum or a portion of a logical block in the filesystem. This is RAID.

Apple's RAID and encryption tools are not the only ones you could use, but this is how they are currently engineered - to be mutually exclusive.

share|improve this answer
add comment

The previous answer I gave here was wrong (as is bmike's answer).

The previous answer I gave was that if you have this as a problem, a workaround is to create an encrypted disk image that covers the entire AppleRaid set. This works, in theory, but is so horribly slow (like more than 10x as slow as the raw disk access) that it is basically unusable, which led me to look at the diskutil command line utility in more detail. And what do you know --- you CAN do what is wanted, it just takes some work. You have to do it through the command line, and even there you can't do it with the simplest commands, but it can be done and it is 100% legitimate Apple supported, not some weird hack.

So, let's assume you have your Apple Raid volume, which you have created somehow, either through Disk Utility or through the command line.

Note: This process will format your RAID and encrypt it. Backup any data you want to keep (at least twice) before proceeding.

The first thing we need is to know the low-level OS identifier for the Apple Raid volume of interest, so type:

diskutil list

which will give you a list of the various hard drives, partitions and logical hard drives (eg Apple RAID volumes) on your system. Look at the list and figure out, based on name, size, whatever, which is the Apple RAID volume we wish to encrypt. Make sure you get the RIGHT identifier, otherwise you'll destroy some other volume. It's wise, when doing this, to disconnect (manually --- pull out the cables!) all hard drives not relevant to the problem, including, most obviously, your backup drives!

So the list tells us the device of interest is, say, disk7

Next we want to create a Core Storage LVG (Logical Volume Group) wrapper around the device. I'm not going to claim I understand Core Storage terminology, and why they use a different word for everything compared to Apple RAID, but far as I can tell, the LVG is essentially Core Storage's version of a logical hard drive. So type:

diskutil cs createLVG BackupImacLVG disk7

BackupImacLVG is the name we are giving to the logical hard drive we're creating. This command will take a few seconds, then spit out a long string which is is the "name" (the UUID) of the LVG we have created. We use it in the next step.

We're not done. We now need to create the equivalent of a partition (which Core Storage calls a Logical Volume) on this logical hard drive. Here is the next command:

diskutil cs createLV 8C5AED3-0CCF-4155-8E3D-DF7D9E68EE7B JHFS+ BackupImac 100% -stdinpassphrase

In the command above: 8C5AED3-0CCF-4155-8E3D-DF7D9E68EE7B is the LVG UUID we were just told (make sure you use your own), and JHFS+ is the file system we want to create in the partition. BackupImac will be the name of the volume created in this partition. 100% says how much space we want to give to this partition. (There are a few different ways to specify sizes, but most people will probably use 100%). -stdinpassphrase says that we want to use encryption.

The command line will then put up a prompt of:

Passphrase for new volume:

You enter the password, and you're done. (Note none of the helpful Apple FileVault UI here! No offering to save your password for you with Apple, no second request for the password to make sure you typed it correctly!)

The end result of all this is exactly what you would hope for and expect. An encrypted volume with all the performance of the previous AppleRAID volume. (And if you look at the diskutil man page, you will see that they explicitly list Apple RAID volumes as supported targets for diskutil cs createLVG, so this isn't some strange edge case that isn't officially supported.)

Disk Utility.app doesn't update its UI (it's really bad in this respect --- has been an ongoing problem in OSX) so quit it and restart it. You'll now see, along with your RAID slices, a new "hard drive" called BackupImacLVG (or whatever you called it) along with a partition called BackupImac (or whatever you called it), with a format of "Encrypted Logical Partition".

One thing to be aware of. The disk is mounted during the creation process without asking for a password (you gave the password in the command line).

Right after you are done, you may want to unmount the volume, power down the hard drives of the AppleRAID volume, power them on again, and see what happens. If you have done everything correctly, once all the slices of the Apple RAID have spun up and been detected by the OS, a window should appear on the screen asking you for the password so that the disk can be mounted.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.