4

I see other questions regarding encrypting Time Machine backups to external disks, like this one:

If I encrypt a Time Machine backup disk, is the entire disk encrypted or just the Backups.backupdb directory?

There it says the entire disk is encrypted.

But for a network disk, I find it hard to believe that Time Machine can encrypt the disk. For example, is remote encryption of an entire disk possible via SMB?

Of course, Time Machine still supports encryption to a network drive, so then what exactly is it doing?

Improve this question

1 Answer 1

Reset to default
8

Neither the remote disk nor the remote volume is encrypted by Time Machine. Instead a special "sparse bundle (disk image)" ("backupbundle" for Catalina) is created on the network drive. In fact it's no uniform disk image file like a dmg but a special folder containing sub-folders and config/log files.

The content of the source volume(s) is saved as AES-128-encrypted band (or chunk) files in the bands folder.

The password is merged into a special file named token in the backupbundle.

The remote disk or volume could be encrypted independently though. This depends on the (TM-)server config.

Improve this answer
5
  • 1
    "Neither the remote disk nor the remote volume is encrypted" - surely the underlying filesystem the sparsebundle is stored on could be encrypted as well. Just as macOS won't know if your NAS share is ext4 or BTRFS or whatever it won't know if it is encrypted.
    – lx07
    Commented Dec 26, 2019 at 16:29
  • @lx07 Thanx for the correction
    – klanomath
    Commented Dec 26, 2019 at 16:36
  • So then the disk image can be moved to other disks like any other TM backup, correct?
    – emiller
    Commented Dec 26, 2019 at 17:25
  • @emiller In theory, yes. You have to relink the new network volume name with the respective credentials/(=reconfig TM) though: after setting up a network-TM-destination the path/creds are saved locally and the tm-daemon will mount (and unmount) the dest-volume automatically (and not visible for the user). This will break after moving the backupbundle to another path/network-vol.
    – klanomath
    Commented Dec 26, 2019 at 17:34
  • One thing cought my attention: "The password is merged into a special file named token" - doesn't this make the entire encryption process pointless? I mean what happens if somebody steals the backup drive and therefore has access to the 'token' file?
    – adamsfamily
    Commented Dec 11, 2020 at 18:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .