I have a macbook pro and I want to encrypt the whole system with filevault.

My question is now, how secure are my data for removing hard disk from device and mount it in an external case?

For example someone steal my macbook, while it is in hibernate. Now, he won't shutdown the system clearly, open the case and remove the HDD.

Are the data already encrypted, even it is not shut down correctly?

2 Answers 2


Yes. FileVault 2 uses 128 bit AES encryption on all the data on your disk. This is why when you turn on FileVault, you will experience a background task grinding through your entire volume, encrypting the data as it goes. Once complete, only someone with your passphrase will be able to decrypt the data, even if they remove the drive from your Mac.

  • Okay, thanks for your answer. I asked it, because what I found in the Internet, it says once the password is entered (what I do, because it's already up) the disk is decrypted. Same info about BitLocker from Windows. So I wonder, when my hdd is encrypted again.
    – Surras
    Feb 3, 2016 at 16:53
  • Technically, that's incorrect. The data on your disk is always encrypted -- the tool that reads the data off your disk just happens to have the correct "key" (your passphrase) to unlock what it's reading, on the fly. The same is true for BitLocker, too, as well as any other FDE (Full Disk Encryption) utility.
    – Alphaman
    Feb 3, 2016 at 16:57

Yes, once removed, the data can only feasibly be accessed by someone with your password.

However, if the attacker gets your computer while it is still running, then uses a USB attack to either force a login as you or creating a new admin (root) account, without the system turning off or rebooting, then your data is at risk. It's possible, but currently difficult.

Another mechanism is to use one of the new, "Cold Boot Tamper" techniques which require that the attacker physically compromise your system without your knowledge, tricking you into giving the attacker your password. Obviously, the problem for the bad guy is that they'd need to have ongoing, surreptitious access to your system. Here is a link to a recent paper on this technique, Attacking the BitLocker Boot Process, which is similar to one made for the Mac for a recent security conference.

What all this boils down to is the need for users to make use of multiple layers of security, including physical security, to make the attacker's job so difficult that it discourages 99.9999% of attacks from being pursued to completion.

  • Okay, if my data so important that someone starts such kind of a attack to me and my data, then I have some other problems and I should better looked out for better security techniques. For realy sensible data I have an encrypted container on my disk too. The FileVault is, so my opinion, against nosy people with a bit more knowledge about the PC system
    – Surras
    Feb 3, 2016 at 18:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .