Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am conserned about cold-boot attacks on my full disc encrypted (filevault2) laptop.

Therefore I am wondering if the memory image dump to /var/vm/sleepimage is encrypted before it is saved to disk?

I notice that the suspended drive asks me for my password before unlocking so it appears this is the case, but could anyone confirm this?

share|improve this question
up vote 4 down vote accepted

Everything written to the volume under Filevault 2 is encrypted live and in-stream by the kernel / device drivers.

As long as there isn't a bug where data leaks to outside the core storage wrapper, you don't need to worry about someone analyzing the contents of your RAM by snooping the locked drive.

share|improve this answer
So the only issue I need to worry about is FireWire attack on the computer while turned on then. Thanks for your answer! – Christopher Käck Jun 6 '13 at 15:17
Yes - worrying about a lost key that will decrypt the Core Storage volume (or compromised passcode) from the running system (or observation) or a backup location is a much higher risk than unraveling the encrypted bits on Filevault IMO. – bmike Jun 6 '13 at 16:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.