Can someone suggest a clever way to identify all dmg that are encrypted?

My only idea is rather complicated. use mdfind '(kMDItemFSName=*.dmg)' and then test the response from hdiutil imageinfo and log the result of those that ask for a password. Thanks to the answer and comments, the following command runs all the dmg through hdiutil, but I can't figure out how to identify the ones that give an error. Any ideas?

mdfind -0 "kMDItemFSName=*.dmg" |xargs -0 -I{} -L 1 hdiutil imageinfo {}
  • 1
    AFAIK There is not an extended file attribute for encrypted .dmg files, e.g. using ls -l@ might show com.apple.metadata:kMDItemDownloadedDate there is not a com.apple.metadata:kMDItemEncrypted. You can see the metadata attributes of a file using mdls. So using hdiutil imageinfo is probably the only way to get directly from the file itself. You could script it and pipe the output of hdiutil imageinfo to grep, etc. and further process it so the final output might be list of files that are encrypted, etc. It all depends on really what you're trying to accomplish to begin with. Oct 16, 2015 at 18:07
  • Hi. I only want to know which dmg are encrypted. To make a list.
    – jakethedog
    Oct 16, 2015 at 19:14

3 Answers 3


At the present time on my local disk I have 88 .dmg files, three of which are encrypted. Before running the command line below I didn't know how many encrypted .dmg files I had and if any, where they were. So while the following command line may look convoluted nonetheless it should work as advertised.

Open Terminal and copy and paste the entire command line below, as is, into the Terminal then press Enter.

mdfind '(kMDItemFSName=*.dmg)' | while IFS= read -r line; do printf "$line " & hdiutil isencrypted "$line"; done > dmg_file_list; grep ': YES' dmg_file_list > encrypted_dmg_file_list; clear; cat encrypted_dmg_file_list

This will create two files, dmg_file_list and encrypted_dmg_file_list, and output the contents of the latter to the Terminal. The files can also be opened in a text editor.

The files will contain the fully qualified pathname of the .dmg files followed by a space and either encrypted: NO or encrypted: YES in the dmg_file_list file and only the fully qualified pathname of the .dmg files followed by a space and encrypted: YES in the encrypted_dmg_file_list file.

You can then manually delete the two files created by the command when finished with them.

Note: Once the command line is executed if may take a moment to process and output the contents of the encrypted_dmg_file_list file to the Terminal. It will depend on just how many .dmg files there are.

Here is the full command line shown with line continuation so you make sure to copy and paste the entire line. (You can actually copy and paste the command line in this format too.)

mdfind '(kMDItemFSName=*.dmg)' | while IFS= read -r line; \
do printf "$line " & hdiutil isencrypted "$line"; \
done > dmg_file_list; grep ': YES' dmg_file_list > encrypted_dmg_file_list; \
clear; cat encrypted_dmg_file_list
  • I probably would grep for "encrypted: YES" in case the output of hdiutil changes in the future. Also if you use >> dmg_file_list you may want to remove an already existing file first (or use > dmg_file_list).
    – nohillside
    Oct 17, 2015 at 6:46
  • @patrix, The >> was typo. I've corrected it. As to greping for more then I did... well things do change and code does get broken however it just needs to get fixed then. What I provided was a working example of just one way to accomplish the goal. It's not the only way or necessarily the best way, just a way that worked on my system and can be adapted as necessary by whomever choses to use it. As an example I could have written it so the encrypted_dmg_file_list file just had the fully qualified pathname as the file is designated as encrypted. I didn't because it's late and I'm tired. :) Oct 17, 2015 at 7:06
  • this worked. thank you! but it exits with an error: LSOpenURLsWithRole() failed with error -600 for the file /Users/user/encrypted_dmg_file_list. any ideas?
    – jakethedog
    Oct 17, 2015 at 7:56
  • Replace the open in the last line with cat, this will list the encrypted volumes directly in Terminal.
    – nohillside
    Oct 17, 2015 at 8:05
  • @melchior, per the cat suggestion by patrix, I've edited the command line as then it's not dependent on open any changes from the default with Launch Services. You can always open the files manually in a text editor too. Oct 17, 2015 at 8:17

Spotlight just doesn't have sufficient metadata to differentiate the filesystem choices stored inside a DMG. Put another way, it's like asking what Pages documents have French words in them just using mdls. The data to make that search isn't contained in metadata.

The proper command to check if a specific image file is encrypted is hdiutil isencrypted /path/to/dmg


host:~ user$ hdiutil isencrypted /Users/user/Downloads/test.dmg


encrypted: YES
blocksize: 512
uuid: DE78A7BE-2B64-4556-8EC9-93DFAC15A839
private-key-count: 0
passphrase-count: 1
max-key-count: 1
version: 2
  • How would this work together with mdfind etc?
    – nohillside
    Oct 16, 2015 at 19:52
  • 1
    @patrix I'm just trying to create the proper mdfind | xargs | hdiutil (| grep) command
    – klanomath
    Oct 16, 2015 at 19:54
  • This is +1 by me. It's bordering on "homework" and "do my work for me" which is what the OP seems to be seeking from recent questions, @patrix
    – bmike
    Oct 16, 2015 at 19:56
  • 1
    @bmike it is close, but i can't figure out how to show the file that results in encrypted: YES. And for the record, it is very much a personal project, looking for a particular dmg out of hundreds from over ten years ago. this will help me a lot. long past the days of homework.
    – jakethedog
    Oct 16, 2015 at 20:08
  • Excellent @melchior - learning pipe-fu is hard. My main suggestion is to pipe the output of the partial command to a file then cat that file to the next command. Then you can see what your working with and if you have an odd error, try inspecting the data to see which piece is causing the failure
    – bmike
    Oct 16, 2015 at 20:22

A solution using mdfind -0 and xargs :

mdfind -0 "kMDItemFSName == '*.dmg'" | xargs -0 -IX ksh -c '
    if    hdiutil isencrypted "X"  2>&1 | grep -q "encrypted: YES"
    then  echo "X -ENCRYPTED"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .