Do you encrypt your drives?

[Saint 112]

Hi all

With a neighbor of mine we plan to host each other's back-up drives. Hopefully no burglar will raid both our homes and no airplane will crash on them and no meteorite either, etc.

Therefore we will avoid paying for cloud back-up.

I think it's best to encrypt the data. I never used the APFS encryption feature of Disk Utility. Do any of you use it and what is your experience with it?

What is the case-sentive option for?

TIA

Nick

 

[Greybeard2023]

Hi all

With a neighbor of mine we plan to host each other's back-up drives. Hopefully no burglar will raid both our homes and no airplane will crash on them and no meteorite either, etc.

Therefore we will avoid paying for cloud back-up.

I think it's best to encrypt the data. I never used the APFS encryption feature of Disk Utility. Do any of you use it and what is your experience with it?

What is the case-sentive option for?

TIA

Nick

My Time Machine drives are encrypted - seems to work - and also I have FileVault turned on so my main system drive is also encrypted.

If its a recent Mac it should have hardware encryption so performance shouldn't be an issue.

Experience is positive - you just have to remember the password - although I have an Apple keyboard with a fingerprint reader so that's taken care of most of the time.

 

[Pierre Lagarde]

Hi all

With a neighbor of mine we plan to host each other's back-up drives. Hopefully no burglar will raid both our homes and no airplane will crash on them and no meteorite either, etc.

Therefore we will avoid paying for cloud back-up.

I think it's best to encrypt the data. I never used the APFS encryption feature of Disk Utility. Do any of you use it and what is your experience with it?

What is the case-sentive option for?

TIA

Nick

I usually use encryption for laptops ("Filevault", so, in mac universe). It takes an initial time to encrypt but it's quite seamless after that.

You need to be careful saving keys, but the tool let you know everything you need to know in the process.

Case-sensitive means the system can store two files with same name but different capitalization. Most of the time macOs don't need to use case-sensitive volumes. If you need to save some files that has to be differentiated by the case of certain characters in their name, you need to have a volume that is case-sensitive. For instance, on a case-sensitive volume, files like aFile.txt and AFile.TXT could be two different files on disk, but not if the volume is case insensitive.

I had to do this, for instance, because I was saving files from a Linux system to a drive that was managed by macOs at some point. If you don't need it, just keep it off.

It's usually not needed for macOs system in standard usage.

On the other hand, macOs file system stores a kind of "Display" name for each file with case information. This name can be changed to have specific case presentation for each character, but still, if the volume is case insensitive, the "real" file name on disk will be the same, whatever is the case of each character.

In the example above, on a case insensitive volume, if you change AFile.txt to aFile.txt, you will be able to see this presentation of upper/lower case, but you won't be able to add a file named AFile.txt (or with any other capitalization to it) in the same folder.

 

[Saint 112]

Thanks for your quick response.

My Time Machine drives are encrypted - seems to work - and also I have FileVault turned on so my main system drive is also encrypted.

The difference between FileVault and encryption is not clear for me.

If its a recent Mac it should have hardware encryption so performance shouldn't be an issue.

It's an M1 MacBook

Experience is positive - you just have to remember the password - although I have an Apple keyboard with a fingerprint reader so that's taken care of most of the time.

Well, we have got to live with it. ;-)

Nick

 

[Saint 112]

Thanks for your quick response Pierre.

I usually use encryption for laptops ("Filevault", so, in mac universe). It takes an initial time to encrypt but it's quite seamless after that.

So you can apply FileVault to an existing drive without needing to format it, right?

You need to be careful saving keys, but the tool let you know everything you need to know in the process.

Well, that's the issue with keys in general.

Case-sensitive means the system can store two files with same name but different capitalization. Most of the time macOs don't need to use case-sensitive volumes. If you need to save some files that has to be differentiated by the case of certain characters in their name, you need to have a volume that is case-sensitive. For instance, on a case-sensitive volume, files like aFile.txt and AFile.TXT could be two different files on disk, but not if the volume is case insensitive.

OK. I am used to give precise, unique, non case-sensitive names to all my files. So it's not an issue.

Nick

 

[Pierre Lagarde]

Thanks for your quick response Pierre.

I usually use encryption for laptops ("Filevault", so, in mac universe). It takes an initial time to encrypt but it's quite seamless after that.

So you can apply FileVault to an existing drive without needing to format it, right?

Yes, at any time... just longer initial encryption with bigger and/or slower drives and/or more data.

[UPDATE] Sorry, I misunderstood you needed encryption for external drives.

Since 2018 systems and/or T2 chipset, FileVault refers to the "mechanism" that is used for boot/data/system volume. Volume encryption is just using similar encryption but with a different context of protection (depending on system/hardware version).

The best document I found to describe precisely what's under the hood is here : https://eclecticlight.co/2025/01/10/filevault-and-volume-encryption-explained/

Anyway, principles of usage are quite simple and can be summed up this way : It protects your external drive with a dedicated password. Encryption works the same for the rest and can be set at any time (right click in Finder on the volume and choose "Encrypt").

 

[Greybeard2023]

Thanks for your quick response.

My Time Machine drives are encrypted - seems to work - and also I have FileVault turned on so my main system drive is also encrypted.

The difference between FileVault and encryption is not clear for me.

It does seem confusing.

The support doc says:

"If you have a Mac with Apple silicon or an Apple T2 Security Chip, your data is encrypted automatically. Turning on FileVault provides an extra layer of security by keeping someone from decrypting or getting access to your data without entering your login password."

Mac User Guide

This implies data are always encrypted.

But in the system settings on my Mac it says:

"FileVault secures your data by encrypting the contents of your Mac and locking your screen with a password."

Which seems different.

 

[Mike Boreham]

Thanks for your quick response.

My Time Machine drives are encrypted - seems to work - and also I have FileVault turned on so my main system drive is also encrypted.

The difference between FileVault and encryption is not clear for me.

You can only FileVault a boot drive. An external can be encrypted by Finder, right click> encrypt if existing data or format encrypted in Disk Utility for a new volume.

Finder encryption an already loaded drive can be slow (took 77 hrs for 2TB HDD for me recently). It is usually quicker in practice to erase and reformat encrypted and reload data from a back up.

Turning on FileVault on a boot drive is instant.

There has been a recent good thread on this topic, including ways to monitor progress of Finder encryption, in this thread .

 

[JPAlbert]

Encryption sounds great...
... until you really need something on an encrypted drive, and find that (for whatever reason)... you can't get to it.

The only encrypted volume I have (on many drives) is a single partition I keep on an external cloned backup with stuff like banking on it, etc. I store it in the car as "an off-site backup".

But all my other drives are "in the clear".
I WANT the stuff on them to be easy to get to, especially in "a moment of extreme need".

(I realize there are some who have no choice to encrypt, such as work requirements, etc.)

 

[Saint 112]

OK folks!

I think I got it. As a summary (correct me if I am wrong):

• FileVault is for the start up drive only. It can be applied and removed any time.
• Encryption is for external drives and must be done at the formatting.

In both cases you need to remember your password. Do you use one only for all drives or one for each?

Thanks you all for your insights.

Nick

 

[Greybeard2023]

In both cases you need to remember your password. Do you use one only for all drives or one for each?

Personally I'd use the same password to make it easier to remember - its not like the Internet where you want to avoid sharing passwords in case one gets hacked.

 

[Mike Boreham]

OK folks!

I think I got it. As a summary (correct me if I am wrong):

• FileVault is for the start up drive only. It can be applied and removed any time.
• Encryption is for external drives and must be done at the formatting.

In both cases you need to remember your password. Do you use one only for all drives or one for each?

Thanks you all for your insights.

Nick

You can encrypt an external after formatting and loading, with Finder > right click . Encrypt. See my post earlier with link to thread about this method.

The default password for FileVault unlocking is the user password, and in daily use you don't not have to enter it each use. It adds a very small amount of time to the boot process. Don't confuse the unlocking password with the FileVault Recovery key which you do have to record and is only used if you have forgotten your password and need to recover the drive. It is saved for you in the new Passwords app.

The encryption password for externals you chose in DU or when you start encryption.

 

[Saint 112]

Experience is positive - you just have to remember the password - although I have an Apple keyboard with a fingerprint reader so that's taken care of most of the time.

When I got my M1 MB Air and set it up I did the fingerprint procedure but never dared using it for fear it wouldn't work well. ;-)

Nick

 

[Pierre Lagarde]

Experience is positive - you just have to remember the password - although I have an Apple keyboard with a fingerprint reader so that's taken care of most of the time.

When I got my M1 MB Air and set it up I did the fingerprint procedure but never dared using it for fear it wouldn't work well. ;-)

Nick

I've been using fingerprint id from the start on mine, and it's the best I used so far on any machine. Not even a glitch in more than 3 years.

 

[graybalanced]

There are lots of different concepts flying around here, and not all of the answers are sufficiently accurate.

Encryption-

Yes, I encrypt all drives containing personal or business data, including Time Machine backups. I take my laptop a lot of places including business trips. If a computer, external drive, or backup drive is lost or stolen, I am absolutely not interested in providing anyone with a treasure trove of open data about me, my family, and my business, our names, our legal documents, account numbers and other detailed financial asset information, photos, emails, messages, etc. I do not want all that dumped into some international identity theft cloud server. It could be an absolute disaster which I will prevent by using strong encryption, which Apple has so nicely made a very high priority for their hardware and software. For this same reason I also always enable FileVault for the boot drive and encrypt all external drives that could contain personal data.

I also don't want my photos and videos ending up on some shady AI training or stock photo server in who knows what unregulated country.

Encryption + backups means a lost/stolen laptop is not that big a deal. The hardware is insured so I can just go get a new one. The files are encrypted so personal data will not fall into the wrong hands, and I can rebuild the entire laptop just by restoring the last encrypted Time Machine backup to a new Mac.

Encryption used to be a pain because it was slow. Several years ago, Apple started enabling hardware-accelerated encryption. I think it was in the T2 chip originally? This made encryption so fast that on SSDs, it will not usually impact overall performance. Yes, encryption is much slower on hard drives, and is still best done when formatting because that takes no time at all compared to using the Encrypt command on the right-click menu. Note that if you right-click an encrypted volume, the command shows up as Decrypt.

FileVault/encryption password-

In both cases you need to remember your password. Do you use one only for all drives or one for each?

It's a lot easier to use one well-guarded password for all encrypted drives. Although with today's password managers it's somewhat workable to make a different password for each drive, but I think that gets too complicated as drives are added, removed, reformatted...

Case-sensitive-

For normal users there is no reason to turn on this obscure Unix option. For the users of this forum there is one very very strong reason to not use case-sensitive: Adobe apps don't like it. For example, if you look at the Photoshop system requirements right now, there is a line that has been in there for years:

Photoshop will not install on a volume that uses a case-sensitive file system

TouchID-

When I got my M1 MB Air and set it up I did the fingerprint procedure but never dared using it for fear it wouldn't work well.

The fact is the biometrics (TouchID and FaceID) are merely convenience features that do not replace the login password. They're just shortcuts. If you enabled TouchID/FaceID and it fails to recognize you, next the Apple device will ask you for your login password/passcode, so you are not locked out if they stop working, it just falls back to the password.

I often use my devices in public places like cafes and airports, and for that reason I LOVE the TouchID/FaceID biometrics, because when I use them, no one, and no cameras in the room, can watch or record me typing in my passwords!

 

[paulraphael]

I'm adding this for a little clarity, because FileVault works fundamentally differently from how it used to. It's actually had its architecture changed a number of times.

First, if you have an Apple Silicon Mac, your system drive is always encrypted. There is no way to have it otherwise.

In the default configuration, the system itself holds the encryption keys, which presents a small security vulnerability. Turning on FileVault does one thing: it encrypts these keys with your own personal key, so now you're the only one holding the keys. FileVault turns on instantly and causes no performance hit, because it doesn't touch your data or directories; they were already hardware-encrypted.

This hardware encryption (and FileVault) are unfortunately only available for the system drive. For external drives the most reasonable solution is to format them with APFS encryption. This may or may not affect performance. Howard Oakley did tests with a number of different drives, and found the results were completely drive-dependent.

I've chosen to not encrypt my external media drive (a u.2 enterprise SSD in a Thunderbolt enclosure). But I'm not convinced this was the best choice. Photoshop and LightRoom reads and writes don't seem limited by the drive.

For a Time Machine drive, just choose encryption in the options when setting up Time Machine. Any performance hit is irrelevant here.

 

[Saint 112]

The fact is the biometrics (TouchID and FaceID) are merely convenience features that do not replace the login password. They're just shortcuts. If you enabled TouchID/FaceID and it fails to recognize you, next the Apple device will ask you for your login password/passcode, so you are not locked out if they stop working, it just falls back to the password.

That's what I was afraid of.

Nick

 

[Saint 112]

Thanks paulraphael for your clear exposé.

Nick