15

I have a folder containing files including Wills, Trusts, personal financial statements etc. Most of these files are word docs, excel spreadsheets, PDF's and jpegs. I would like to protect this folder from prying eyes.

If this info was housed in a .dmg, it would seem pretty straightforward to click on the .dmg, enter my password, mount the drive, access the information/folder and when finished, eject the disk image knowing it is closed and protected.

Am I missing something? Any pros/cons of this idea?

1
  • 2
    As you might need these files even when your Mac breaks, keep in mind that DMG files are conveniently read on Mac machines, but not so easily on Windows PC's. If you need the files fast and have no access to Mac you might have trouble accessing them on a Windows machine. Feb 6, 2013 at 15:59

5 Answers 5

15

Your use case is exactly why encrypted DMG were created. The external file name can be different than the actual name of the filesystem can be obfuscated while the drive is not mounted.

The only con (which kind of is a Pro) is that spotlight can't search within an unmounted image and you may want to disable spotlight entirely on that volume just in case you don't want any extra caches / extra access that isn't necessary.

Alternatives to this is storing text in a keychain secure note, especially if you keep alternate keychains for more secure information. I also find myself storing more things in 1Password when I don't need a self-contained archive for things like certain client data or certain data I wish to be doubly encrypted. (I use FileVault on most Mac these days so that everything is encrypted at least once.)

4
  • Thank you for your prompt reply. When you say "you may want to disable spotlight entirely on that volume", I assume you mean by dragging the Disc Image Icon or adding it to the privacy part of the Spotlight preferences. Is that correct? I tried to drag/add the actual .dmg file, but it's grey-out and can not be added. Thanks again, FH Feb 5, 2013 at 21:50
  • 4
    A quick way to do that is to run this terminal command while your disk is mounted: touch /Volumes/NameOfYourDMGVolume/.metadata_never_index. That will create an empty file that Spotlight will see and know not to index the volume.
    – JRobert
    Feb 5, 2013 at 21:57
  • BTW, this works with any other volume; putting a .metadata_never_index file in the root of e.g., an external HDD or flash drive, works to prevent it being indexed as well.
    – JRobert
    Feb 5, 2013 at 22:18
  • Yes - there are several ways a file or directory can be excluded and I usually drag items into the preference pane as you described. The hidden file is slick, but I don't trust myself to notice when something hidden disappears should that file get deleted. I use the . file for when I want to stop indexing a new drive temporarily, so it's very useful nonetheless.
    – bmike
    Feb 5, 2013 at 22:41
4

Using a disk image .dmg to hold your private documents is an ideal use of disk images. Apple provide detailed steps for setting up such a disk image, how to create a password-protected (encrypted) disk image.

Applications > Utilities > Disk Utility.app

Use the Disk Utility application to create a sparse bundle disk image with 256-bit AES encryption. These two settings ensure you have a secure container that can grow to accommodate more files in the future.

You should select a suitably large initial size, such as 8 GB or more. The initial disk image will not be 8 GB but will be able to to grow as you add files.

You should disable Spotlight indexing on your secure volume by creating a .metadata_never_index file. You can do this through the Terminal.app:

  1. Mount your secure disk image;
  2. Launch Terminal.app;
  3. Change in your secure volume's root directory: cd /Volumes/<secure volume name>
  4. Create the invisible never index file: touch .metadata_never_index

New Image settings in Disk Utility on Mac OS X 10.8

2
  • Just curious, why a sparse bundle instead of a regular sparseimage?
    – SilverWolf
    Dec 13, 2018 at 4:44
  • A bundle means the disk image is represented by many individual files within a folder (the bundle). Changes to the contents of the disk image will only affect some of those files. This can be useful if the image is being backed up – only the changed files need be copied for incremental copies. Does this make sense? Dec 13, 2018 at 8:04
4

Like the other guys said, dmg is probably the best way to keep important folders encrypted. However, you should keep in mind the following:

  1. When you create a dmg file, you must specify its size. Once done, it will have that size no matter what you delete from it. Also, you will not be able to add anything in dmg further to that size. There is a way to resize dmg, like any other partition, you can do it from Disk Utility. So in terms of size, it's not optimal per se.
  2. If you want a "flexible" encrypted file, you should use sparse image or sparse bundle image. The first is one large file, the second is a collection of small files (which can be handy). Both types require that you define maximum size, but will physically take as much space as you really put into them. However, as far as I know, if you delete things, they won't shrink - there is a manual way to shrink them from Terminal.

One thing important to me (may or may not be to you): dmg files, even encrypted with 256 AES, can be open in Windows, using appropriate apps. To me, this means I don't depend on Mac, even if I lose it, I can still access backed up dmg files from any machine (any means Windows, over 90% out there are, like it or not). However, sparse and sparse bundle files can't be accessed from Windows, so you're stuck with Macs. To me, this is a dealbreaker for sparse stuff.

3
  • 1
    How do you access a .dmg file on Windows - let alone an encrpted one
    – mmmmmm
    Nov 4, 2013 at 23:45
  • 1
    There is a Question about that on SuperUser : superuser.com/questions/42338/… Nov 5, 2013 at 0:04
  • Yup, there it is. I contacted the DMGExtractor staff and they answered positively: it CAN open even the 256-bit encrypted DMGs. However I haven't yet tried it myself, so I can't speak from experience.
    – Martin
    Nov 14, 2013 at 22:41
3

TrueCrypt is an open source utility (Mac, Windows, Linux) that can encrypt and decrypt a group of files into a archive. It is multiplatform, fast and portable. You can also add a hidden partition that is not visible if you need a second layer of security. I recommend taking a look at this.

http://www.truecrypt.org

2
  • While considerably faster, using TrueCrypt is not recommended by the TrueCrypt community itself with the following warnings on the website: "WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues" and "You should download TrueCrypt only if you are migrating data encrypted by TrueCrypt". Jun 1, 2014 at 20:47
  • Version 7.1a of TrueCrypt, not the latest version, is still are to use, according to Steve Gibson of Gibson Research, a leading security resource. Read more and decide for yourself. grc.com/misc/truecrypt/truecrypt.htm
    – mkaz
    Jun 18, 2014 at 9:53
0

I have to add my two bits here about password strength. As I stated before any encrypted volume will only be as secure as the password you are using.

The real issue is how strong the password for the encrypted volume is. If the password is not a random string of characters, but based on a dictionary word with substitutions of 1 for i etc, the files while encrypted might as well not be.

Ensure your password is based on a long sentence where you use all punctuation marks, include spaces, numbers and special characters.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .