3

I need to do remote checks to verify OSX has filevault enabled. When you enable filevault, does it create / change something on the HDD that I can check for on VPN login using my posture assessment tools?

  • Are you using only the command line or can you view GUI? Assuming VPN login allows you to view GUI you can just go to Disk Utilities > Select HDD Partition > If it's encrypted it should say at the bottom Format : Encrypted Logical Partition – Hengjie Nov 8 '12 at 10:06
  • Hi only command line. We dont trust the users :). – Rob Veiga Nov 8 '12 at 14:49
6

Can you run a command line tool, such as fdesetup?

$ sudo fdesetup status
FileVault is On.

fdesetup also accepts the verb isactive, which returns 0 if FileVault is enabled (checking a return value is arguably more reliable than reading the text):

$ sudo fdesetup isactive
$ echo $?
0

fdesetup does require root access, which might be a problem.

You could also run diskutil cs list and check for the encryption status. The exact wording you're looking for is a bit complicated because of all the different possible combinations, this script might be a good start.

  • Hi, another question. Does enabling filevault create a file somewhere on the file system that would not exist when filevault is disabled? – Rob Veiga Nov 12 '12 at 11:06
  • Not that I know of. If you want to check, you could do a backup with Time Machine, enable/disable FileVault, and then use tmutil compare to see if any relevant-looking files have changed. But there's nothing I'm aware of. – gabedwrds Nov 12 '12 at 14:50
4

fdesetup seems only avaliable on Mountain Lion.

Try this script on Lion: https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/filevault_2_encryption_check/filevault_2_status_check.sh

The basic idea is: diskutil cs list

0

The rtrouton script mentioned previously seems needlessly complicated (I ended up there first, but after reading half of it came here). I'm probably going to start with the below and wrap a little more logic around it.

diskutil cs list | grep "Fully Secure"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .