External drive APFS encryption secure

apfsdisk-utilityencryptionSecurity

I just erased a newly purchased external USB disk using the Disk Utility program and set it to use the file system APFS Encrypted. I entered a strong password and the whole process took about a minute, then the device was supposedly encrypted and ready for use.

I noted that APFS encryption uses AES-128 which seems good, but the fact that the formatting only took a minute seems weird. Using encryption software like TrueCrypt, to safely prepare a new device takes hours, even days, just to fill the disk with random data before any valuable data is saved onto the device. For this reason, I am concerned that my APFS encrypted device is not secure enough.

Are my concerns legitimate or have I misunderstood something here?

Best Answer

Did you click click Security Options, and use the slider to set how any times the data should be erased?

Writing over the disk is to stop old files from being accessible.

The time to encrypt a disk depends mostly on how many files need to be encrypted and it they old files should be overwritten. As it is a new drive there won't be a lot of files to convert.

Related Solutions

APFS folder encryption

One possible way to do this without resorting to the command line is to create a resizable encrypted volume through Disk Utility. It acts as a folder that is decrypted during the mounting process. It supports APFS and AES 128/256.

To create a new blank encrypted folder:

Disk util > new image > new blank image > set Format: APFS > choose encryption scheme > set Image Format: read/write > OK.

To encrypt an existing folder:

Disk util > new image > new image from folder > APFS > choose encryption scheme > set Image Format: read/write > OK.

This will create the encrypted folder as a .dmg that is decrypted when you mount it. Once mounted it acts just as a normal folder.

Cannot change APFS encryption password

You need to list your disks to find the APFS volume disk where you want to change the password:

sudo diskutil apfs list

Now find the UUID of the cryptographic Disk User:

sudo diskutil apfs listUsers <your APFS volume, like: disk1s1>

Finally you can change the APFS volume password:

sudo diskutil apfs changePassphrase <your APFS volume, like: disk1s1> -user <the Disk User cryptographic UUID, like: 12345678-1234-1234-1234567890AB>

Best Answer

Related Solutions

APFS folder encryption

Cannot change APFS encryption password

Related Question