0

I created an encrypted APFS volume on my internal SSD on my MacBook. I also use Time Machine.

How can I use Time Machine to:

a) Restore a previous version of the whole encrypted APFS volume?

b) Restore an old version of an individual file within the encrypted APFS volume?

Regarding a): What do I have to do to achieve this?

Regarding b): I assume that this is not possible since Time Machine cannot see inside the encrypted volume. If someone can confirm this, this would be helpful.

One solution would be to not use an encrypted APFS volume but an encrypted sparsebundle. But I had trouble increasing its size. An APFS volume in contrast always takes only as much space from its parent as it needs for its content.

2
  • 1
    Did you create a volume (partition on the disk), or did you create an encrypted APFS-formatted DMG file?
    – nohillside
    Jan 22, 2023 at 16:09
  • I created a volume. Thanks, that comment led me to the solution of my problem. See my own answer below.
    – John
    Jan 22, 2023 at 16:36

2 Answers 2

1

Time Machine only backs up volumes that are "mounted" (meaning they appear in Finder and are browsable).

If the encrypted volume was mounted, then Time Machine would back it up like a regular disk, since it's been unencrypted and made available to browse by mounting it.

If you enabled encryption on your Time Machine disk, then it would be re-encrypted when it is transferred to the disk. Otherwise, it is unencrypted.

So, to answer your question, yes: Time Machine will back up encrypted volumes, provided they are mounted (unlocked) and not in the exclusion list.


I am unsure how to restore the entire volume, however you can certainly access the volume and restore individual files by opening the Time Machine disk, selecting the backup revision, and navigating to the volume. I've attached a screenshot of these steps on my Time Machine disk:

Restoring Time Machine Files

2
  • Thanks. I‘d rather not backup the mounted, decrypted drive since the data should stay encrypted. (Although my backup disk is also encrypted, the key is stored in the keychain. Therefore, the backup disk can be accessed by everyone who is logged in. I also want to have the APFS volume mounted for only brief periods of time and not wait for a backup to finish then.) My hope is that the whole encrypted volume can be backed up. I just have not found out yet if that is the case and how I can restore it with Time Machine.
    – John
    Jan 22, 2023 at 16:00
  • 1
    Right, you cannot backup an encrypted volume "as-is" without a disk image like you described. This is because volume encryption/decryption is "invisible" and happens automatically at a layer lower than Time Machine operates
    – Ezekiel
    Jan 22, 2023 at 23:57
0

My solution is now to create a blank image with the Disk Utility app (File - New Image - Blank Image…) instead of a Volume (+ button at the top of the Disk Utility window).

I chose:

  • APFS
  • 256-bit AES encryption
  • GUID partition (Apple recommends this for „for all Intel-based and Apple silicon Mac computers“)
  • Sparse bundle disk image (so that it is stored as a folder with many files inside for a more efficient backup process)

The encrypted .sparsebundle is backed-up by Time Machine like other files in the file system.

I wanted to add the mounted disk to the Time Machine exclusion list so that the decrypted files are not backed up. However, that was not necessary since it was already in the exclusion list. This makes absolutely sense since Time Machine backs up the encrypted .sparsebundle file already.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .