1

Question

MacOS does offer automatic disc encryption for at least 2 "types" of hard drives in the system:

  • Internal APFS Hard Drive with FileVault
  • External Time Machine Hard Drive (If set up in Time Machine Preferences)

Result of diskutil list for external Time Machine Drive via diskutil list:

        /dev/disk3 (external, virtual):
    #:                       TYPE NAME                    SIZE       IDENTIFIER
    0:                  Apple_HFS DISK                +499.4 GB   disk3
                                    Logical Volume on disk2s2
                                    [redacted]
                                    Unlocked Encrypted

As we can see, system manages to encrypt and decrypt Time Machine disk (in this case) automatically

Problems

  1. Is there any way in MacOS for automatic external disc encryption and decryption? When disc is plugged, system does decrypt its content and allow normal operations, leaving disc encrypted when disconnected from the system
  2. Would external ssd's with hardware encryption benefit from it using MacOS built-in FileVault features, or does it only apply for disk manufacturer proprietary software?
Improve this question

1 Answer 1

Reset to default
3

Yes, it is possible for macOS to automatically handle encryption of external drives in the sense that when you plug the disk in, you're asked for an unlock passphrase - and when you unmount the drive, it is encrypted and safe for transport.

An easy way to do this is to open Disk Utility and then plug in an empty external drive. Choose to Partition the drive (make sure the external drive is selected in the left side bar) - and choose to format the drive as "APFS (Encrypted)". You will automatically be asked for a passphrase, and the system will automatically ask you to unlock the drive when plugging it in.

NOTE: Partioning and formatting the drive will erase your existing files on the drive. Please take a backup before doing so!

Regarding your second question - no, FileVault does not as such benefit from hardware encryption feature on external SSDs. This is really a good thing, as recently it was unveiled that these hardware encryption features on many popular SSDs are really very insecure. For example by having built-in backdoor password that are extremely simple (such as a blank password).

On Windows the BitLocker feature in some cases rely on the external hardware's encryption features, and for those users that meant that their security had been compromised all along. Therefore, even though it sounds counter-intuitive, it was really an advantage that File Vault 2 does not rely on the encryption in the SSD controller of the external drive.

Improve this answer
3
  • Thank you for your answer, just two more questions: 1) Does not relying on hardware encryption affect performance od the Disk? and 2) related to 1 - Is disk being encrypted on the fly or only when being ejected? If latter, what about situation when disk is ejected not properly (eg. just plugged off the computer): would it still be encrypted?
    – Jakub Pastuszuk
    Dec 20, 2018 at 11:29
  • 1) Depends on the disk. But as long as you have a relatively modern machine, it is not noticeable. 2) On the fly.
    – jksoegaard
    Dec 20, 2018 at 11:57
  • In my experience its about a 20% performance hit. I think Apple should allow those of us that are good at firmware updates to use SED and store the password in the keychain for auto-mounting, then at least we can change the password without losing the entire disk.
    – malhal
    Nov 13 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .