25

I'm unable to encrypt an USB thumb drive on MacOS High Sierra. Although I tried different approaches, it never worked:

  • Use Finder (right-click, then select "Encrypt Drive"): this option is not visible on my machine
  • Use Diskutil (no option to use encryption)
  • Use diskutil command line tool: unable to reformat as APFS, no clue what to do next…
Improve this question
  • Same Problem here on my Mac mini. All menus which allow me to encrypt external drives are missing. But macOS shows the menu item "Decrypt" on all already encrypted drives and doesn't have problems mounting them. – DiableNoir Oct 8 '17 at 15:38
  • @DiableNoir are you on High Sierra, too? I'm sure , it is related to High Sierra. Meanwhile, I was able to create an APFS formatted drive through command line; will document the steps here later. – Moritz Petersen Oct 9 '17 at 11:22
  • Yes the menu items are missing after updating to High Sierra. I also lost every option you listed before. macOS only offers decryption of already encrypted external drives. Currently I don't use APFS and I also don't want to use it, due compatibility issues to other systems I use. – DiableNoir Oct 9 '17 at 16:27
15

This is an example workflow to encrypt an USB thumbdrive with HSF+ (Journaled) with diskutil using the command line.

Assuming you start with a MS-DOS formatted USB stick.

Step 1: List all currently mounted disks diskutil list:

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *8.1 GB     disk2
   1:                 DOS_FAT_32 MYSTORAGE               8.1 GB     disk2s1

You see the disk MYSTORAGE has the identifier disk2s1 and is DOS_FAT_32 formatted.

Step 2: Now format the disk disk2 as HSF+ (Journaled):

diskutil eraseDisk JHFS+ "New Storage" GPT disk2

The name of the disk will be "New Storage". At this time it is not yet encrypted. Look at the list of disks diskutil list:

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *8.1 GB     disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:                  Apple_HFS New Storage             7.7 GB     disk2s2

Step 3: Now you see the "New Storage" partition with identifier disk2s2. Encrypt this partition using:

diskutil cs convert disk2s2 -passphrase

Enter the passphrase when prompted.

If you list the disks now, you also see the encrypted logical volume diskutil list:

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *8.1 GB     disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:          Apple_CoreStorage New Storage             7.7 GB     disk2s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk2s3

/dev/disk3 (external, virtual):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS New Storage            +7.3 GB     disk3
                                 Logical Volume on disk2s2
                                 8B474F90-34B7-49FE-95E0-E8B260C51CCF
                                 Unlocked Encrypted

If you skip step 3, you can also encrypt the disk using Finder:

Right-click on the drive and select "Encrypt drive-name"

Just right-click on the drive and select "Encrypt drive-name".

Caution: If you choose this alternative approach, the disk gets formatted as APFS encrypted disk!

Improve this answer
  • Thank you! This helped me encrypt my external USB drive when I couldn't previously. – LarsH Aug 16 '18 at 20:35
12

The Answer of Moritz Petersen is correct, but it only works because he is using a "GUID Partition Map" in Step 2.

So I can offer an alternative Answer: You can also use the graphical Disk Utility of macOS to encrypt your external disk. Choosing "GUID Partition Map" instead of "Master Boot Record" makes all missing menu options visible. After changing the Partition Map even the Finder offers you a file system encryption.

Disk Utility "Erase"-Dialog after choosing "Master Boot Record":

Disk Utility using MBR

Disk Utility "Erase"-Dialog after choosing "GUID Partition Map":

enter image description here

Improve this answer
  • 5
    Where can I choose "GUID Partition Map"? I do not see such an option anywhere in the Disk Utility... – Alex Jan 28 '18 at 9:50
  • Select the disk (not the partition, since its at the beginning oft the disk!) and then the combo box "Scheme". Please note, that this will also clear your partition table and all your partitions! – DiableNoir Jan 28 '18 at 15:34
  • 1
    @PeterFox I checked it again and it also works for USB keys and USB hard drives. But again: It's important to choose "GUID" as Scheme before (!!!) you choose the format. Did that work for you? – DiableNoir May 10 '18 at 10:09
  • 11
    Disk Utility has two view modes for the left panel : Show only volumes and Show all devices, accessible via the View dropdown in the top-left corner. Devices and partitions have different erase options - in Show only volumes mode (which was the default for me), you'll be offered the single partition version of Erase, which doesn't give you the option of changing the scheme (which is a device level option). Switch to Show all devices and right-click on the device to see the full set of erase options. – Chris Jun 18 '18 at 9:54
  • 2
    Alex is right, sometimes there is no Scheme field shown, in which case this answer doesn't work. (And therefore it's incorrect that Moritz's answer only works because he uses GPT in step 2. It works because he bypasses this information-hiding behavior of the Disk Utility GUI.) Chris's point about changing the view mode to show devices is key to using the GUI solution... my fresh OS install had view mode set to Show only volumes by default too, preventing access to the GPT scheme and the encryption option. – LarsH Aug 16 '18 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .