6

I just wiped my 500GB disk on my Mac Mini (2011 model) to freshly reinstall macOS Sierra.

  1. I restarted the system, pressed CMD+R to get into recovery mode and went into disk utility.
  2. I erased the macOS partition and formatted it with journaled and encrypted file-system. Picked a password, and good.
  3. I quit the disk utility and selected 'Install macOS'.

This told me it will check eligibility of my device and due to my encrypted disk it will ask for the password during installation. And it did. I entered the password and the process continued until at some point it aborted with the following message:

macOS could not be installed on your computer.

Storage system verify or repair failed.

Now my only option is reboot and remove the encryption via disk utility. I was not able to install macOS onto a fully encrypted disk. Is this desired behaviour? How to install macOS on a encrypted, journaled file-system?

I'm usually installing my Linux systems on fully encrypted disks, thus I am wondering whether this is also possible with macOS Sierra.

Improve this question
6
  • 2
    Silly question (mine, not yours) but did it fail multiple times? It could be because the whole disk isn't encrypted. I've never used encryption on a drive so this is all just speculation but... Have you tried creating a thumb drive installer and then formatting the entire disk and setting up that way? I just have a feeling that it's aborting when trying to organise the recovery partition.
    – Sera H
    Dec 21, 2016 at 12:40
  • 1
    I agree with Stuart H's feeling about the recovery partition. An encrypted non-system volume and an encrypted macOS boot volume have a slightly different layout. The unencrypted RP contains a hidden intermediate key to unlock the main boot volume on the same disk. The Boot OSX partition following an encrypted non-boot volume doesn't. Simply install macOS onto an unencrypted volume and enable FileVault afterwards in the security prefpane.
    – klanomath
    Dec 21, 2016 at 13:00
  • @StuartH yes. that's what I did, tried multiple times and ended up with the same error message eventually. the general problem is that macos does not really provided you with details about the error. I have no clue about a recovery partition or partition layout in general. all I can tell is that I encrypted the formerly unencrypted main harddrive partition where macos was installed to.
    – q9f
    Dec 21, 2016 at 13:26
  • @klanomath yeah, that's what I'm doing now since I don't have time to wait for a solution. however, I still want to figure out whether it is possible to first encrypt the disk and then install macos, as the filevault post-encryption mechanism takes several days to complete.
    – q9f
    Dec 21, 2016 at 13:27
  • @klanomath pointed out that I did not answer the question exactly. I will leave my previous post since it may be useful to someone. I do have an ugly hack that I think will work (I have done this before). You can attach an external disk to your machine, blank it out, and install the macOS onto that external disk. Then use Carbon Copy Cloner, or similar, to copy that external disk back onto your already encrypted disk. I have done this before and it works. The only drawback is that you will have to enter your password twice when booting. Once to unlock the disk and a 2nd time to login.
    – Rumboogy
    Dec 21, 2016 at 22:06

4 Answers 4

Reset to default
4

I just did this so I know it works:

  1. Format the target disk "Mac OS Extended (Journaled)" - but not encrypted.
  2. Install macOS Sierra on the fresh, unencrypted disk.
  3. Finally, turn on disk encryption (called FileVault). This can be done near the end of installing Sierra (it prompts you if you want encryption), or after the install is done. Either way is fine.

If you do it in this sequence then everything works.

A few other thoughts:

  • I would also recommend to format it the disk as a single partition. I have had issues with disks formatted with multiple partitions when using encryption on one or more of the partitions. Perhaps that bug has been fixed now, but I don't know so I would not risk it.
  • After you enable encryption, wait for the encryption process to finish before installing other software or making big changes. You can see the progress of the disk encryption by going to System Preferences -> Security & Privacy -> FileVault. The encryption process is disk intensive so it is best to just let if finish before doing other disk intensive things.
  • For non boot partitions, it is fine to format them as encrypted - e.g. Mac OS Extended (Journaled, Encrypted). It is only bootable partitions that need to follow the above sequence to avoid trouble.
Improve this answer
5
  • 1
    This isn't an answer to the question! The question is how to install macOS to an already encrypted but empty volume!
    – klanomath
    Dec 21, 2016 at 17:47
  • Exactly. I'm looking for a way to encrypt before installation.
    – q9f
    Dec 21, 2016 at 22:26
  • @klanomath if it's empty, then the easiest way is to reformat it without encryption in disk utility before installing.
    – Display Name
    Dec 22, 2016 at 6:32
  • Upvoted. I just did this seconds ago. I erased a 2015 MacBook Air entirely, using the secure erase feature in a Parted Magic boot disk, then I internet-booted onto the Mac with Option + Command + R, reformatted the empty internal SSD with the Apple Disk Utility, then reinstalled MacOS Monterey. At the end of the installation it let me set up the File Vault. When I went to check System Preferences -> Security & Privacy -> FileVault, it was already fully encrypted and done! I think SSDs are so fast now this is almost instant. So, this approach works great and is fast!
    – Gabriel Staples
    May 24 at 19:51
  • See also my comment here. I'm disappointed Apple still doesn't allow installing to a fresh disk that was formatted with the "APFS (Encrypted)" filesystem right from the start.
    – Gabriel Staples
    May 24 at 19:52
3

I know you have a working answer already, but I thought to share my experience anyway, only updated for High Sierra and using Apple's new file system APFS.

My motivation: I was driven by the (constantly varying) 6-14 hour estimate for FileVault to finish on a new install with no additional user data.

So this is what I did to install macOS on an already-encrypted filesystem - much like yours:

  1. Create a bootable macOS installer
  2. Erase and format as APFS (Encrypted)
  3. Install High Sierra

Pros:

  1. < 10 mins to encrypt by Disk Utility? (possibly less, I didn't monitor closely)
  2. FileVault already enabled.

One main difference is that you supply a password earlier when formatting with Disk Utility, rather than being given one (the Recovery Key) when enabling FileVault post-install.

Hope this helps someone.

Improve this answer
2

A thumb drive installer solved it for me. Thanks to comment by Stuart H.

Download the macOS Sierra installer.

Type (or copy and paste) this command into Terminal, replacing Untitled with the name of your drive, then press Enter: 

sudo /Applications/Install\ macOS\ Sierra.app/Contents/Resources/createinstallmedia --volume /Volumes/Untitled --applicationpath /Applications/Install\ macOS\ Sierra.app --nointeraction && say Done

Hold option key at power up & select attached thumb drive device to boot.

As necessary, run Disk Utility to erase & format the destination drive to the journaled, encrypted option and then proceed with install to the destination drive.

Ref: http://lifehacker.com/how-to-make-a-bootable-macos-sierra-usb-flash-drive-1786853248

Improve this answer
0
1

I've had this error happen when the partition previously contained a FileVault-encrypted macOS installation. Reformatting as encrypted in Disk Utility and reinstalling macOS fails shortly after entering the disk password after the reboot, as you described.

However, I found that it works if you format as unencrypted, install macOS, then go back to recovery, reformat as encrypted, and install again.

It's sort of an awkward workaround, and there might be a simpler solution, but that's what worked for me. My guess is that there's some information about the old FileVault setup in NVRAM or something that doesn't get cleared out when you reformat with Disk Utility, and it confuses the newly-installed system that's booting from a partition with different encryption settings. Booting from an unencrypted partition apparently clears out that old FileVault data, which paves the way for a new encrypted installation later.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .