I have FileVault enabled, so my home directory is encrypted. However, programs and libraries often use directories outside of /home; and Disk Utility allows us to create encrypted files and directories at arbitrary locations.

How can I tell if a file or directory is encrypted? Does Finder or a command line tool offer something?

  • What's your operating system? – Harv Oct 22 '14 at 5:50
  • @Harv - I'm running OS X 10.8.5. But the question is more general. In the general case, I might do this from a shell script during an audit. And I'm interested in an Apple solution, and not arbitrary tools like Truecrypt (my bad, I should have stated that). – user83961 Oct 22 '14 at 15:47

If you're using FileVault 2 (OS X Lion and newer), the entire boot partition will be encrypted, which includes your home folder as well as Applications.

I ran the following command and part of the output shows I am using an encrypted, unlocked volume:

ashley@sidekick-4:~$ sudo diskutil list
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *251.0 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:          Apple_CoreStorage                         250.1 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Macintosh HD           *249.8 GB   disk1
                                 Logical Volume on disk0s2
                                 Unlocked Encrypted
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *2.0 TB     disk3
   1:                        EFI EFI                     209.7 MB   disk3s1
   2:                  Apple_HFS Time Machine Backups    2.0 TB     disk3s2
  • Thanks @Harv. Is there anything more granular than a volume? I'm interested in seeing if /tmp or /opt are encrypted. – user83961 Oct 22 '14 at 15:50
  • @jww well, if the system is using OS X Lion or greater, and FileVault is enabled, the entire boot volume will be encrypted. From terminal: $ diskutil info /dev/disk1 (for me that's my boot volume -- use diskutil list to see your volumes) shows lots of information about it. At the bottom, you'll see info about whether it's a Core Storage Logical Volume, and whether that volume is encrypted. – Harv Oct 22 '14 at 17:01
  • @jww and, if they're using FileVault 1 (older than OS X Lion), then it's only the home folder that's encrypted. The boot volume is "normal" with a sparsebundle for the users' home. That gets unpacked on boot, so that when the user enters their password the sparsebundle opens and they have access to their files. – Harv Oct 22 '14 at 17:02

Since Lion OS X uses full disk encryption for filevault2. Therefore it creates corestorage volumes on your disk and overwrites the entire contents with encrypted data. This encryption process takes a while, depending on your system speed. Only after that your disk is "secure".

You can see the partition's encryption status either in the System Preferences > Security & Privacy > Filevault. Or use the diskutil corestorage list command in Terminal. Look for the fields Conversion Status and Fully Secure. I had cases when the encryption was not successful but received no error message.

    > diskutil corestorage list
    CoreStorage logical volume groups (1 found)
    +-- Logical Volume Group XXX
        Name:         10.8
        Status:       Online
        Size:         669162500096 B (669.2 GB)
        Free Space:   16777216 B (16.8 MB)
        +- Logical Volume Family XXX
            Encryption Status:       Unlocked
            Encryption Type:         AES-XTS
            Conversion Status:       Complete
            Conversion Direction:    -none-
            Has Encrypted Extents:   Yes
            Fully Secure:            Yes
            Passphrase Required:     Yes
            +-> Logical Volume XXX
                Disk:               disk1
                Status:             Online
                Size (Total):       668826951680 B (668.8 GB)
                Size (Converted):   -none-
                Revertible:         Yes (unlock and decryption required)
                LV Name:            XXX
                Volume Name:        XXX
                Content Hint:       Apple_HFS

You must log in to answer this question.