Will it work well to use a .dmg as an encrypted folder?

Question

I have a folder containing files including Wills, Trusts, personal financial statements etc. Most of these files are word docs, excel spreadsheets, PDF's and jpegs. I would like to protect this folder from prying eyes.

If this info was housed in a .dmg, it would seem pretty straightforward to click on the .dmg, enter my password, mount the drive, access the information/folder and when finished, eject the disk image knowing it is closed and protected.

Am I missing something? Any pros/cons of this idea?

Answer 1

Your use case is exactly why encrypted DMG were created. The external file name can be different than the actual name of the filesystem can be obfuscated while the drive is not mounted.

The only con (which kind of is a Pro) is that spotlight can't search within an unmounted image and you may want to disable spotlight entirely on that volume just in case you don't want any extra caches / extra access that isn't necessary.

Alternatives to this is storing text in a keychain secure note, especially if you keep alternate keychains for more secure information. I also find myself storing more things in 1Password when I don't need a self-contained archive for things like certain client data or certain data I wish to be doubly encrypted. (I use FileVault on most Mac these days so that everything is encrypted at least once.)

Answer 2

Using a disk image .dmg to hold your private documents is an ideal use of disk images. Apple provide detailed steps for setting up such a disk image, how to create a password-protected (encrypted) disk image.

Applications > Utilities > Disk Utility.app

Use the Disk Utility application to create a sparse bundle disk image with 256-bit AES encryption. These two settings ensure you have a secure container that can grow to accommodate more files in the future.

You should select a suitably large initial size, such as 8 GB or more. The initial disk image will not be 8 GB but will be able to to grow as you add files.

You should disable Spotlight indexing on your secure volume by creating a .metadata_never_index file. You can do this through the Terminal.app:

1. Mount your secure disk image;
2. Launch Terminal.app;
3. Change in your secure volume's root directory: cd /Volumes/<secure volume name>
4. Create the invisible never index file: touch .metadata_never_index

Answer 3

Like the other guys said, dmg is probably the best way to keep important folders encrypted. However, you should keep in mind the following:

1. When you create a dmg file, you must specify its size. Once done, it will have that size no matter what you delete from it. Also, you will not be able to add anything in dmg further to that size. There is a way to resize dmg, like any other partition, you can do it from Disk Utility. So in terms of size, it's not optimal per se.
2. If you want a "flexible" encrypted file, you should use sparse image or sparse bundle image. The first is one large file, the second is a collection of small files (which can be handy). Both types require that you define maximum size, but will physically take as much space as you really put into them. However, as far as I know, if you delete things, they won't shrink - there is a manual way to shrink them from Terminal.

One thing important to me (may or may not be to you): dmg files, even encrypted with 256 AES, can be open in Windows, using appropriate apps. To me, this means I don't depend on Mac, even if I lose it, I can still access backed up dmg files from any machine (any means Windows, over 90% out there are, like it or not). However, sparse and sparse bundle files can't be accessed from Windows, so you're stuck with Macs. To me, this is a dealbreaker for sparse stuff.

Answer 4

TrueCrypt is an open source utility (Mac, Windows, Linux) that can encrypt and decrypt a group of files into a archive. It is multiplatform, fast and portable. You can also add a hidden partition that is not visible if you need a second layer of security. I recommend taking a look at this.

http://www.truecrypt.org

Answer 5

I have to add my two bits here about password strength. As I stated before any encrypted volume will only be as secure as the password you are using.

The real issue is how strong the password for the encrypted volume is. If the password is not a random string of characters, but based on a dictionary word with substitutions of 1 for i etc, the files while encrypted might as well not be.

Ensure your password is based on a long sentence where you use all punctuation marks, include spaces, numbers and special characters.