5

Using FileVault 2, when connecting a disk in target mode, the disk is locked and can only be unlocked by users authorised to do so. However, once it is unlocked, all contents are accessible to the User unlocking it. Is there a way to keep individual users' files encrypted, while making the 'general' part of the disk, and the files belonging to the user unlocking the disk accessible?

6

In general, you can't keep any files from an administrative user that knows how to modify file permissions.

FileVault is to keep untrusted users out of the entire disk - so you cannot allow an admin user/password into the hands of someone you don't trust.

You can make individual disk images and encrypt them with passwords that are not shared and that will ensure that other Admin accounts cannot look at the files. They could copy the store somewhere else and try to brute force things, they could install keyboard monitoring software to hope to catch you typing the passphrase, but they can't get into each user's private store without another piece of information.

This was one benefit of the older FileVault implementation where each user had their own store / their own key and the risk of cross contamination of user files was lessened.

  • Knowing this about the old FileVault I was quite surprised to find this out. I'm not a Mac person but a friend asked me to review whether they could give their Mac to somebody for servicing. It seems like the answer is no...any user you give a service place to use for testing is going to leave the data in your own user account up for grabs. Is there a standard way of mitigating this in the Mac world? – Caleb Oct 21 '16 at 14:43
  • @caleb the easiest mitigation is to have a second layer of encryption for sensitive files in your home folder. You can store the passphrase for that further encryption in your keychain or not as you choose and shortcuts will automatically navigate and mount the encrypted storage as needed – bmike Oct 21 '16 at 16:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .