My Mac book pro was stolen. ML 10.8.2. I successfully restored all system from Time Machine backup. I remember having turned on FileVault on my user account on original system. But on restored system that account has FileVault turned off. Does it mean account on original system had FileVault turned off as well?

And related question. FileVault was turned on on Lion or even earlier. Usual system upgrades should keep FileVault turned on, right?


Mount the Time Machine drive / volume on your desktop and navigate to the snapshot you used to restore the Mac.

In the /Volumes/path_to_tm/Backups.backupdb/Mac_Name/Latest/HD_Name/Users folder, you will either see a directory or a file.sparsebundle named for your user's short name.

If you see a .sparsebundle, you had FileVault 1. If not, then not.

The answer here also depends on which version of FileVault (1 or 2) you were using on the missing Mac.

FileVault 1 is based on encrypting just the home folders of accounts as opposed to encrypting everything on the Disk. If you enable FileVault in OS X 10.3 - 10.6, this is what you get; upgrading to 10.7/10.8 will leave the encryption intact (now called "Legacy FileVault").

If you recover an FV1-protected account, the encryption should be maintained. Since your recovered account is not encrypted, you didn't have this enabled on your account on your old computer.

FileVault 2, on the other hand, is based on encrypting the entire startup volume -- all accounts, the OS itself, etc. If you enable FileVault in OS X 10.7 or later, this is what you get. You can also "upgrade" from Legacy FV to FV2 by disabling Legacy FV, then enabling FV2 (note that Apple recommends doing this, but it is not automatic).

If you had FV2 enabled on your computer, there's no way (at least, no easy way) to tell from the backup. 10.7 and later allow you to encrypt the backup, but that's independent of encryption on the startup volume (i.e. it's entirely possible to have an unencrypted backup of an encrypted system, or an encrypted backup of an unencrypted system). Also, the restored account will be unencrypted, unless you specifically enable FV encryption on the new computer.


If I remember correctly, until recently Time Machine backups were unencrypted, even if FileVault was turned on. I think in Mountain Lion you can now encrypt time machine backups (though not Time Capsule ones). If you set this up under Lion, and then maybe your backups were never encrypted - hence FileVault being turned off after the restore?

  • I only care if my stolen mac has FileVault on or off... Oct 9 '12 at 10:00
  • Yes. What I'm saying is that restored system not having it turned on probably doesn't tell you the answer to that one way or the other. I guess the real question is "Does upgrading from Lion to Mountain Lion turn off FileVault?" I'm afraid I don't know an answer to that, though I'd be surprised if it did.
    – Andy Burns
    Oct 9 '12 at 10:51
  • I don't see how encryption (or lack thereof) of the backup disk relates to encryption of the main disk. FV2 works on disk level, so it doesn't matter whether the data written on it comes from an encrypted or unencrypted source.
    – nohillside
    Oct 13 '12 at 7:27

FileVault is a very low-level process, meaning any installe applications does not know whether FileVault was on or off. When data is wrote or read from the disk, it is encrypted on the fly by (I believe) the kernal. THerefore, when Time Machine backed it up, it read the unencrypted files (as it didn't know the drive was encrypted).

If you turned FileVault on, you are fine. My general policy is to purchase an insurance policy through my insurance policy, and if someone was stupid enough to try and steal it, I would thrash it on the ground. I am out a Macbook wither way, but this way I get to throw a Macbook on the ground and destroy it, they do not get it, and my data is safe. It's a win-win-win.

And the insurance company buys me a new one. In short, there is NO way to tell from the TimeMachine backups. If you enabled it, then yes, it is enabled and your data is safe. Best of luck!

  • 1
    You can still know if the user was protected under FileVault 1. If the user remembers turning on FileVault for the user, then that's a pretty strong indication they should be able to tell if that operation was preserved or undone by looking at the backup files.
    – bmike
    Feb 27 '13 at 17:02
  • ML 10.8.2 is not FileVault 1, so unless he was using an old laptop that has been upgraded 3 or 4 versions, he shouldn't be on FileVault 1. And given that it was stolen, it probably wasn't terribly old. I think some assumptions are safe to make. They will correct us if they are wrong and we will be happy to update our answers. Feb 27 '13 at 17:31
  • I agree. Even better - when we call out our assumptions - the thousands of people that see this question and answer can use all of the answers to help them. Yes, we want to help the OP, but I'm also commenting for the wider audience.
    – bmike
    Feb 27 '13 at 17:41
  • I respect you for aiming it towards the broader audience, and most of my answers on the SE network do that too, but that doesn't mean my answer has to in this instance. They are more beneficial, but unnecessary in this instance IMHO. Why the downvote? Feb 27 '13 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .