I have an external USB hard drive with many encrypted APFS volumes on it.

I have a second identical external USB hard drive.

Is there a macOS program that lets me clone the first to the second without mounting the encrypted volumes, and in a incremental way (e.g. subsequent copies only copy the changes)?

I think all macOS based back up programs are like rsync in that they operate on the files (not on disk's).

Disk Util has "Restore", but this copies a lot of data if I have only changed a few bytes.


1 Answer 1


No, what you ask is simply not possible - given that you mean the usual things by "mount" and "incremental".

An unmounted, encrypted volume is in simple terms roughly indistinguishable from a bunch of random bytes. There's no way to tell from this volume alone whether any block of data is "changed" or not.

You can definitely copy the data from one drive to the other. That's just a question of doing a bit-for-bit copy using a program such as the built-in dd command in macOS.

If you bend the usual understanding of working with non-mounted disks - and imagine a program that would decrypt the volume (given you had the password), parse the file system, and use timestamps, snapshots or another method of finding the changes and map those back to the source bytes - then yes, theoretically you could create such a tool. However at that point you could just as well have mounted the drive.

You could also bend the usual understanding of incremental backups - and imagine a program that reads through all of the source drive while reading through all of the destination drive - and then copy over only what has been changed. It would be almost trivial to make, but I don't recall any macOS program doing this. On Linux you could use programs such as diskrsync and Bscp to do this - although both are build to transfer the disk to a remote computer, you could have both the local and remote computer be the same. I don't know if these programs can be compiled and successfully used on macOS, but if you want to build your own tool, you could do it by porting over diskrsync.

This would make sense if you have a drive where reads are fast and writes are slow. It would stil be a very slow proces compared to usual incremental backup tools, such as for example Time Machine, where the set of changes can be calculated quickly by looking at the source volume only.

There are other tools out there for cloning disks and trying to make that process faster. For example the partclone_apfs program makes it possible to clone APFS file systems from disk to disk - copying only the blocks that actually contain data. If the volume has a lot of free disk space when mounted, this will speed the process up considerably. However, it does not work for encrypted volumes.

Finally, you could imagine up solutions that worked by tracking changes using snapshots on the local drive. As that would mean modifying the drive you're trying to clone, this would usually not be an option.

  • Thanks. "bunch of random bytes" - but are these bytes ordered/do they have regions, so if I add 1KB of data to a file, a small amount of those encrypted bytes will change? Or do all of the bytes get shuffled? I was thinking of a merkle tree for ranges of bytes to detect changed bytes.
    – zino
    Jan 22, 2022 at 18:20
  • Depends on what you mean by “ordered”. There’s as such no other order to the data other than the fact that hard drives can be thought of as storing data in numbered locations. Of course all the bytes are not shuffled - only a small amount will change in that scenario. Did you learn of Merkle trees from reading the link I provided? If the question is exactly as you put it, you cannot use Merkle trees - because where would you put it. But if you have a third disk for the Merkle tree, then yes you could use a Merkle tree. However a Merkle tree does not make sense here. Just use a list.
    – jksoegaard
    Jan 23, 2022 at 9:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .