4

I'm new to Time Machine. I just this week got an external hard disk and am starting to use it. My Time Machine backups were spending a significant amount of time in the encryption phase. Upon reading this: https://www.howtogeek.com/305540/how-to-encrypt-your-macs-time-machine-backup/

I thought a better option would be to format the disk as Mac OS Extended (Journaled, Encrypted) instead of the corresponding unencrypted format. If I understand things right I could then do decrypted backups via Time Machine instead of encrypted backups, leaving the encryption up to the OS's writing to the disk via the encrypted file system format. It seems, judging from the question and answers here, that what I'm doing should be reasonable:

Difference between enabling Time Machine's "Encrypt Backups" option, and encrypting from Disk Utility?

So I erased my external drive which only had a few days backups anyway and reformatted it as Mac OS Extended (Journaled, Encrypted). But when I added the disk via Time Machine, selected to not encrypt it, and entered my encryption password, I get a message saying this:

This Core Storage logical volume is already decrypting.

Wait, what? It's decrypting? Why does it need to decrypt anything? The disk is formatted, empty, and ready to fill with data, right? I suppose it doesn't know how full or empty the disk is because the entire disk is encrypted? It has been running, decrypting, for quite a few hours and diskutil cs list shows it as only 12% done:

$ diskutil cs list
CoreStorage logical volume groups (1 found)
|
+-- Logical Volume Group XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
    =========================================================
    Name:         <name>
    Status:       Online
    Size:         2000021315584 B (2.0 TB)
    Free Space:   9392128 B (9.4 MB)
    |
    +-< Physical Volume XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
    |   ----------------------------------------------------
    |   Index:    0
    |   Disk:     disk2s2
    |   Status:   Online
    |   Size:     2000021315584 B (2.0 TB)
    |
    +-> Logical Volume Family XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
        ----------------------------------------------------------
        Encryption Type:         AES-XTS
        Encryption Status:       Unlocked
        Conversion Status:       Converting (backward)
        Reversion State:         Decrypting
        High Level Queries:      Not Fully Secure
        |                        Has Visible Users
        |                        Has Volume Key
        |
        +-> Logical Volume XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
            ---------------------------------------------------
            Disk:                  disk3
            Status:                Online
            Size (Total):          1999659597824 B (2.0 TB)
            Conversion Progress:   12%
            Revertible:            No
            LV Name:               WDExternalDrive
            Volume Name:           WDExternalDrive
            Content Hint:          Apple_HFS

Note, in particular:

Reversion State:         Decrypting

and:

Conversion Progress:   12%

Can someone explain to me what is going on? I'm concerned I'm doing something wrong. When it says that it is decrypting, is it decrypting the freshly encrypted drive so that my snapshots will be stored plaintext on the drive? That's clearly not what I want.


Update

After waiting all weekend, the status now shows that the disk conversion process is completed:

$ diskutil cs list
CoreStorage logical volume groups (1 found)
|
+-- Logical Volume Group XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
    =========================================================
    Name:         WDExternalDrive
    Status:       Online
    Size:         2000021315584 B (2.0 TB)
    Free Space:   9392128 B (9.4 MB)
    |
    +-< Physical Volume XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
    |   ----------------------------------------------------
    |   Index:    0
    |   Disk:     disk2s2
    |   Status:   Online
    |   Size:     2000021315584 B (2.0 TB)
    |
    +-> Logical Volume Family XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
        ----------------------------------------------------------
        Encryption Type:         None
        |
        +-> Logical Volume XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
            ---------------------------------------------------
            Disk:                  disk3
            Status:                Online
            Size (Total):          1999659597824 B (2.0 TB)
            Conversion Progress:   Complete
            Revertible:            No
            LV Name:               WDExternalDrive
            Volume Name:           WDExternalDrive
            Content Hint:          Apple_HFS

But now Time Machine won't let me use the disk because the volume is not encrypted.

enter image description here

Indeed, Disk Utility shows that the format is no longer encrypted:

enter image description here

So it looks like I did something wrong, which was my concern that led me to make the post in the first place. Oh well, it was just machine time. Is what I'm doing misguided? Did I miss a step somewhere or take a wrong turn?

My question still remains: can someone tell me what is wrong with my process? I want to use the filesystem encyrypted format to backup my machine without Time Machine needing to encrypt the disk as a post process operation. Is this possible?

  • it can take 48 hours or more depending on the CPU and cable/plug type – Ruskes Oct 6 '18 at 2:58
  • 1
    @Buscar웃 It's now at 57% about 20 hours after starting, so that seems to be about right. I didn't caffeinate last night, so I'm not sure how much it got done overnight. – firebush Oct 6 '18 at 19:14
  • Go take some well deserved Vacation for few days :) – Ruskes Oct 6 '18 at 19:20
  • and yes do what you have to to keep it running overnight. – Ruskes Oct 6 '18 at 19:21
  • Decryption would be there to unravel an encryptions key and this process does take a while. The good news is Mojave prompts to re-encrypt any destinations when it sees you back up encrypted data on disk0 to a destination that does not use encryption. support.apple.com/guide/mac-help/… – bmike Oct 6 '18 at 20:12
1

In your case for 2 TB drive it can take up to few days.

To keep it working overnight go to System Preferences > Energy Saver and leave the disk running.

Of course leave it plugged in.

Just to make sure it stays awake, you can use the caffeinate in Terminal.

You can check the status from the terminal with diskutil cs info /Volumes/<your drive name> and look for Conversion State and LV Conversion Progress

  • If you have a CPU bound process, it's totally unrelated to this. Encryption and decryption happens on a chip / hardware and is throttled to avoid consuming IOPS and not CPU or memory or anything else you'll measure in Activity Monitor. The answer to give it 24 hours per TB is correct, but not for reason of CPU busy or idle state. – bmike Oct 6 '18 at 20:11
  • The T2 chip is only available on Models from 2018 – Ruskes Oct 6 '18 at 20:55
  • T2 has nothing to do with AES hardware encryption on HFS which is the only type of encryption that Time Machine destinations support. Why are you dropping unrelated tidbits here? It's not worth a -1 vote but I'm not sure what point you're driving at with T2 @buscar. Good edit on CPU contributions. – bmike Oct 6 '18 at 21:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .