1

I have an external FireWire-disk directly connected to a computer for backups using Time Machine. So far, these backups have been unencrypted but now I want to start encrypting my backups (the current backup history should be left as is) but when I try to do that, after entering a password, TM displays a pretty scary dialog (my translation) "Are you sure you want to erase the volume 'Backup' that is currently used for backups? All information on the disk will be deleted and this can not be undone. If you want to enable encryption and use the disk for Time Machine it must first be erased".

Why is that? I thought TM used disk images for encrypted backups, why not just create one of them and ignore the rest of the content of this disk? Is there a way around this? I have tried renaming the Backups.backupdb-folder but it didn't change anything.

1

According to Apple's support documentation, you need to remove the disk and re-add it as an encrypted disk:

  1. Choose Apple menu > System Preferences, then click Time Machine.
  2. Click Select Disk or Add or Remove Backup Disk (if you have multiple backup disks).
  3. Select your backup disk, then click Remove Disk.
  4. Set up the disk again as an encrypted backup disk.
1

Here is my "experiment" on that process and result...

If you right-click on a Time Machine volume, Apple idiotically gives you the option to encrypt it, although this option is correctly missing from other inappropriate drives.

There is no message about what will happen or progress bar, but it changed my SSD's volume file system to APFS, making the volume unusable by Time Machine (which must use the old Mac OS Extended, Journaled file system format). It does not erase your previous backup data, at least. But why Apple would give users an incorrect process and lead them into this losing situation is something Microsoft would have done in the 1990s.

But let's say you want to have an APFS volume of old TM backups you no longer want to backup to. Then Apple should at least pop up a message explaining that's what is going to result.

0

Time Machine uses a disk image if you are backing up over the network (e.g. to a file server, Time Capsule, or something like that); if you opt to encrypt these backups, it uses an encrypted disk image. If you are backing up to a directly connected volume (e.g. FireWire), it just stores the backup files in a folder (backups.backupdb) on the volume; if you opt to encrypt these backups, it encrypts the entire volume (by formatting it in the Mac OS Extended (journaled, encrypted) format).

This means that if you want an encrypted (direct-connect type) backup, you need to encrypt not just the backup, but anything else on the backup volume. If you want some of the disk to store unencrypted files, you'd need to partition it into two volumes (and encrypt just one of them).

The good news is that it should be possible to convert the existing volume to the encrypted variant of Mac OS Extended without deleting its contents. This should leave your backup history intact. To do this, secondary-click (right-click or Control-click) on the backup volume's icon in the Finder, and choose 'Encrypt "<volumename>" from the shortcut menu. It'll prompt for a password and hint, then begin converting the volume over to encrypted format. The volume will still be usable during the conversion, except for a short period when it's unmounted and then remounted in the new format. You can even unmount, shut down, sleep, etc as it encrypts, but all of these will pause the encryption process (until you remount/restart and mount/wake/whatever) and your data is not fully protected until the encryption process has finished.

Warning: I haven't tested this very extensively. I did a quick test on a spare computer, and after conversion it recognized the entire backup history & seamlessly added new snapshots to the backup. But there's a possibility it might not always work, so I can't make any promises.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .