At work, I said to my colleague that it was not possible to enable Filevault on a RAID volume. He was surprised and asked me the technical reason.

So I would like to know. It's strange because Filevault is at the software level while RAID is at the hardware level.

  • You are talking about a RAID volume created by Disk Utility here I assume? – nohillside Feb 8 '13 at 22:05
  • @patrix Yes, for example, 2 internal HDD set in RAID-1 in a Mac Mini. – Benoit Feb 9 '13 at 8:58

The previous answer I gave here was wrong (as is bmike's answer).

The previous answer I gave was that if you have this as a problem, a workaround is to create an encrypted disk image that covers the entire AppleRaid set. This works, in theory, but is so horribly slow (like more than 10x as slow as the raw disk access) that it is basically unusable, which led me to look at the diskutil command line utility in more detail. And what do you know --- you CAN do what is wanted, it just takes some work. You have to do it through the command line, and even there you can't do it with the simplest commands, but it can be done and it is 100% legitimate Apple supported, not some weird hack.

So, let's assume you have your Apple Raid volume, which you have created somehow, either through Disk Utility or through the command line.

Note: This process will format your RAID and encrypt it. Backup any data you want to keep (at least twice) before proceeding.

The first thing we need is to know the low-level OS identifier for the Apple Raid volume of interest, so type:

diskutil list

which will give you a list of the various hard drives, partitions and logical hard drives (eg Apple RAID volumes) on your system. Look at the list and figure out, based on name, size, whatever, which is the Apple RAID volume we wish to encrypt. Make sure you get the RIGHT identifier, otherwise you'll destroy some other volume. It's wise, when doing this, to disconnect (manually --- pull out the cables!) all hard drives not relevant to the problem, including, most obviously, your backup drives!

So the list tells us the device of interest is, say, disk7

Next we want to create a Core Storage LVG (Logical Volume Group) wrapper around the device. I'm not going to claim I understand Core Storage terminology, and why they use a different word for everything compared to Apple RAID, but far as I can tell, the LVG is essentially Core Storage's version of a logical hard drive. So type:

diskutil cs createLVG BackupImacLVG disk7

BackupImacLVG is the name we are giving to the logical hard drive we're creating. This command will take a few seconds, then spit out a long string which is is the "name" (the UUID) of the LVG we have created. We use it in the next step.

We're not done. We now need to create the equivalent of a partition (which Core Storage calls a Logical Volume) on this logical hard drive. Here is the next command:

diskutil cs createLV 8C5AED3-0CCF-4155-8E3D-DF7D9E68EE7B JHFS+ BackupImac 100% -stdinpassphrase

In the command above: 8C5AED3-0CCF-4155-8E3D-DF7D9E68EE7B is the LVG UUID we were just told (make sure you use your own), and JHFS+ is the file system we want to create in the partition. BackupImac will be the name of the volume created in this partition. 100% says how much space we want to give to this partition. (There are a few different ways to specify sizes, but most people will probably use 100%). -stdinpassphrase says that we want to use encryption.

The command line will then put up a prompt of:

Passphrase for new volume:

You enter the password, and you're done. (Note none of the helpful Apple FileVault UI here! No offering to save your password for you with Apple, no second request for the password to make sure you typed it correctly!)

The end result of all this is exactly what you would hope for and expect. An encrypted volume with all the performance of the previous AppleRAID volume. (And if you look at the diskutil man page, you will see that they explicitly list Apple RAID volumes as supported targets for diskutil cs createLVG, so this isn't some strange edge case that isn't officially supported.)

Disk Utility.app doesn't update its UI (it's really bad in this respect --- has been an ongoing problem in OSX) so quit it and restart it. You'll now see, along with your RAID slices, a new "hard drive" called BackupImacLVG (or whatever you called it) along with a partition called BackupImac (or whatever you called it), with a format of "Encrypted Logical Partition".

One thing to be aware of. The disk is mounted during the creation process without asking for a password (you gave the password in the command line).

Right after you are done, you may want to unmount the volume, power down the hard drives of the AppleRAID volume, power them on again, and see what happens. If you have done everything correctly, once all the slices of the Apple RAID have spun up and been detected by the OS, a window should appear on the screen asking you for the password so that the disk can be mounted.

  • Outstanding that you've identified a method. I've been quite wanting this for some time now. Not sure I'm currently willing to image my RAID set so I can format it and then copy back, it's kind of a massive set. Hmmm.. – James T Snell Apr 24 '14 at 22:41
  • When entering the passphrase at the command line there is no confirmation. This is a little hair raising, but afterwards you can go into the GUI DiskUtility and click "Erase" on the partition to get the nice double password prompt with complexity meter. Thanks for documenting this process! – dacc Jan 31 '15 at 7:03
  • @Maynard Handley -- will this work for RAID0 in Yosemite? Thx. – thepen Jun 24 '15 at 3:39
  • I can confirm, for all interested, that this works in El Capitan (10.11), and for Time Machine volumes. – Matt Jan 1 '16 at 22:24
  • 3
    I confirm success for macOS 10.12 Sierra (tested on a Mac Pro). I created an AppleRAID mirror, encrypted journaled HFSX (HFSX is case sensitive HFS+). Disk Utility would hang shortly after completing these steps, so I ended up: 1.) rebooting the Mac, 2.) logging into the Finder, 3.) launching Disk Utility successfully. I also removed a member (physical drive) from the RAID mirror and tested to confirm the remaining member (drive) behaved as expected. It did: upon rebooting the Mac and logging in, the single member could not mount until I entered the correct passphrase. Thank you. – user3051849 Oct 16 '16 at 11:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .