Multiple Time Machine backups, both encrypted and unencrypted

Question

I have an unencrypted Time Machine backup with a long history. I'm planning to add a brand new disk to the Time Machine, and use both to do backups simultaneously.

The new disk will be stored in an off-site location, so I would like to have it encrypted. Is it possible to encrypt only the second backup drive?

Specifically, I do not want to enable encryption on the original backup as well. In part because I understand that this requires Time Machine to make a new encrypted backup, potentially losing the history?

Answer 1

Yes, it's entirely possible to have a mix of encrypted and unencrypted TM backups of the same Mac. In fact, that's exactly what I use for my MacBook Pro: 3 backup drives, one unencrypted drive that stays home, and two encrypted drives that rotate being offsite.

When backing up to a directly-attached disk drive, the only difference between an encrypted and unencrypted backup is how the backup disk is formatted -- an unencrypted backup is in the "Mac OS Extended (Journaled)" format, and an encrypted one is in "Mac OS Extended (Journaled, Encrypted)" format.

However, note that the encryption applies to the entire drive (or volume, if it's split into multiple partitions). That means that if you have two computers backing up to the same disk, they'll both be encrypted (with the same password). Similarly, any other files you happen to store on the backup disk (/volume) will be encrypted as well.

Just for completeness, if you're backing up to a network target (Time Capsule, file server, NAS device, etc), the encryption works quite a bit differently. For network targets, TM creates a disk image on the server and backs up into that, and can use either encrypted or unencrypted disk image formats. As a result, the encryption applies only to the backup itself, not to anything else stored on the server. But it's still possible to mix target types freely: you could have the same Mac backing up to an unencrypted local drive, and an encrypted local drive, and an encrypted network target, and an unencrypted network target. No problem.