A locked hard drive, and how does it relate to encryption

encryptionfilevaulthard drive

When I mount a Mac hard drive on another computer, I often get prompted to "unlock" the drive. What does this mean? Is a locked hard drive different from an encrypted one, or is "unlocking" just decrypting the drive for one-time use (as opposed to permanently decrypting)? When I boot the drive in its normal computer I'm not prompted for a FileVault password, which is what's making me wonder if this is encryption-related or not.

Best Answer

A locked hard drive is a hard drive that is encrypted.

When you unlock the drive you are telling the system how to interpret the encrypted data. Unlike permanent decrypting, the data on the drive stays encrypted, you are just telling it how to read the encrypted data on the fly.

On its normal computer information will have been saved into the system's keychain allowing it to access the drive without prompting you for a code. If you open Keychain Access on that Mac and search for the name of the drive, or sort the list by "Kind", you should find an "encrypted volume password" entry. That is what the Mac is using to unlock the drive without prompting you.

Related Solutions

Is it possible to boot from an encrypted external hard drive

It should work, but if you use SuperDuper! a workaround is necessary:

I backed up my main system volume (hereinafter referred to as "System") to the unencrypted! backup volume (hereinafter referred to as "SystemBackup"). After rebooting to SystemBackup i tried to encrypt the volume SystemBackup, which wasn't successful, because the Recovery HD on the backup disk is missing. SuperDuper! only creates a copy of the system volume.

To get around this you first have to install a working system on the backup disk or use another way to create a Recovery HD volume on the backup disk and then erase the main backup volume again.
Backup your main system volume to the backup volume.
Boot to your (bootable) backup volume SystemBackup
Enable File Vault 2 in the system preferences.
Reboot to SystemBackup like advised and continue encrypting.
After encryption has finished boot to your main volume again
Now backup your main volume as usual using SuperDuper!

In my second/third attempt i used CarbonCopyCloner. In contrary to SuperDuper! CCC creates a backup, which usually includes the Recovery HD:

Backup your main system volume to the unencrypted! backup volume. You might have to initiate the backup of the Recovery HD manually. In my first attempt it was backed up automatically and in a second attempt i had to initiate it manually.
Boot to your (bootable) backup volume SystemBackup
Enable File Vault 2 in the system preferences.
Reboot to SystemBackup like advised and continue encrypting.
After encryption has finished boot to your main volume again.
Now backup your main volume as usual using CarbonCopyCloner.

Even after completely deleting my main disk (File Vault volume & Recovery HD) to simulate a disk failure, i have been able to boot to my system backup volume.

Don't encrypt the backup volume in the Finder (e.g. control-click on the the volume) before or after backing up your main volume!

An important note from the CCC knowledge base:
Mac firmware cannot "see" FileVault-protected volumes larger than 2.2 TB when the disk is attached via USB. If attaching the disk to your Mac via Firewire or Thunderbolt is not an option, create a 2TB partition at the beginning of the external disk to work around this limitation.

MacOS – My Macbook’s hard drive is encrypted using FileVault 2. Will adding a new user with a different password break the encryption

FileVault 2 will encrypt the boot volume and allow you to unlock that volume based upon existing user accounts.

Adding a new user account on OS X El Capitan (10.11.6) will automatically add that account to FileVault 2's list of enabled users. So no, you won't revert your existing setup or remove an existing account's ability to unlock an encrypted volume.

The built-in fdesetup account is also very useful (requires sudo privileges):

 list       [-extended] [--offline] [-verbose]
            List enabled users, or locked volumes.

 enable     [[[-user username ...] [-usertoadd added_username ...]] |
            [-inputplist]] [-outputplist] [-prompt] [-forcerestart]
            [-authrestart] [-keychain | [-certificate path_to_cer_file]]
            [[-defer file_path] [-forceatlogin max_cancel_attempts]
            [-dontaskatlogout]] [-norecoverykey] [-verbose]
            Enables FileVault.  This command will fail if no recovery par-
            tition was found on your disk.

Best Answer

Related Solutions

Is it possible to boot from an encrypted external hard drive

MacOS – My Macbook’s hard drive is encrypted using FileVault 2. Will adding a new user with a different password break the encryption

Related Question