I recently learned that it is possible to encrypt an APFS volume within a container from the CLI using the
diskutil command like so:
diskutil apfs encrypt -user disk disk3s1
disk3s1 is the only volume in the APFS container on my external drive.
disk user is mentioned in the
diskutil man page, but I do not understand what it is. Additionally, if I understand correctly, encrypting the MacOS startup disk using the typical "System Preferences" -> "Security and Privacy" -> "FileVault" tab -> "Turn on FileVault" button achieves essentially the same thing. From what I can see, the difference between the two approaches has to do with the users that can decrypt the disk. Using the "System Preferences" approach, my user (
BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBBBBBB below) has permission to decrypt the disk as does the recovery key (user
CCCCCCCC-CCCC-CCCC-CCCC-CCCCCCCCCCCC below) that was generated when I hit the "Turn on FileVault" button. The differences can be seen using
diskutil once again:
# Volume on the external drive: diskutil apfs listkeys disk3s1 # Cryptographic user for disk3s1 (1 found) # | # +-- AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA # Type: Disk User # Data volume on my MacBook's internal drive: diskutil apfs listkeys disk1s2 # Cryptographic users for disk1s2 (2 found) # | # +-- BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBBBBBB # | Type: Local Open Directory User # | # +-- CCCCCCCC-CCCC-CCCC-CCCC-CCCCCCCCCCCC # Type: Personal Recovery User
I did some internet searching but I could not find satisfactory answers to the following questions; any help is appreciated. Thanks in advance.
- What is the "disk" user? Is it special? Is it universal among all MacOS installs?
- Can I add additional crypto users to
diskutilor some other CLI command?
- Can I add a personal recovery user/recovery key after the fact (e.g. to
disk3s1as shown above) via
diskutilor another CLI command?
- Can I remove crypto users after the fact?
Here are some articles I read before I created this post, listed in no particular order, some more relevant than others.
- APFS technical documentation
- Decrypting an APFS encrypted volume using diskutil on macOS 10.13.2
- Slides from the “Managing FileVault 2 on macOS High Sierra” Session at MacAD UK 2018 Conference
- APFS encryption, ghost guest users, and odd UUIDs
- Making sense of Disk Utility and disk structure in macOS 10.13-10.15
- Working with FileVault Encryption
- Frequently Asked Questions about encrypting the backup volume