My external drive with all my Time Machine backups has been stolen. Can anyone access this data or will they need my Apple ID and/or password?
Mac – Can anyone access Time Machine backups from a stolen HDD
backupencryptionhard drivetime-machine
Related Solutions
No, the backups will not be encrypted automatically, but it's very easy to enable for directly attached disks. Just check "Encrypt Backup Disk" in the Time Machine disk selection settings.
If you're backing up to another Mac, you can use Disk Utility on that Mac to erase non-boot drives and put an encrypted partition on them:
According to Apple, Time Machine keeps backups
- hourly for the current 24 hours
- daily for the last month
- weekly copy until the disk is full
You may be noticing the system deleting "extraneous days", pruning the weeks' worth of daily backups down to the weekly copy.
As long as you can still view the weekly copies in Time Machine, they are still there.
Related Question
- Mac – Should time machine backups be encrypted
- Mac – How to test access to encrypted (FileVault2) Time Machine partition
- Mac – Will I be able to access the Time Machine backups after changing Hard Drive
- Mac – Access emails from Time Machine backups of old machine
- MacOS – Encrypt Time Machine backups without deleting old backups
- Mac – Encrypt backups on encrypted APFS drive for Time Machine backup
- Mac – Transfer time machine backups from unmountable HDD
Best Answer
Short answer - assume YES, and immediately change all your account details, Apple and email ID, cloud access etc. I would also inform your bank, online stores and everyone in your contact book (that they might receive a false comm purporting to be you).
Even with an encrypted drive, forensic level software and hacks (as used by the Police / Military and available to download), can circumvent most protection. For example, I would start by putting the HDD in any Mac, interrupt boot and attempt to change the encryption / Apple ID at root level. This will circumvent an Admin account password / provide access to the keychain on a Mac and it might work for the physical drive if I got lucky. Or I would try replacing the HDD's circuit board with one from an identical model - if the encryption is managed through memory on the board, its now gone.
Having said this, criminals generally fall into too categories, dumb / impatient in which case they wont bother with an encrypted device or capable in which case they will probably be into the data within 24 hours.
When we remove a drive (at work) with any sensitive client data, we physically destroy the internals and spread the pieces or incinerate them. You should bear this in mind if selling your Mac also. Wiped does not mean unrecoverable. Always remove the drive.