Mac – Encrypting from the Disk Utility vs Finder

encryptionhard drivetime-machine

I am testing two methods of encrypting a new hard drive. Using Disk Utility, I erased it and created two equal partitions (10GB each, the rest free space), both "Mac OS Extended (Journaled)".

1) From Disk Utility, I selected the first partition (Seagate1 below). Then, from the "Erase" tab, I selected "Mac OS Extended (Journaled, Encrypted)". Next, I clicked on the "Erase" button. It encrypted it right away, as explained below.

2) In the Finder, I selected the second partition (Seagate2), then selected "Encrypt" from the Finder gear-like drop down menu. It stated encrypting it, at a rate of maybe 100MB/sec (also explained below).

Below is the output of "distill cs list". I know 1) was instantaneous and 2) took 100 sec roughly because I looked at the partial results.
So it looks like the approach 2) is encrypting the entire empty partition.

i) Is this the only difference between 1) and 2)?

ii) In particular, what does "Revertible: No" mean for Seagate1 (see below)?

iii) Which approach is safe for Time Machine backups? I do not want to use the "encrypt backups" option in the time machine because I want to know what is going on.

I found this post somewhat helpful, but it does not answer question iii). The poster is talking about my method 1) vs the TM "encrypt backups" option. The conclusion is that they are the same. I would guess that TM "encrypt backups" is the same as my method 2).

Difference between enabling Time Machine's "Encrypt Backups" option, and encrypting from Disk Utility?

$ diskutil cs list

CoreStorage logical volume groups (3 found)
|
+-- Logical Volume Group E374A008-44C9-4A5F-877E-1A14186EE3C1
|   =========================================================
|   Name:         Macintosh HD
...
...
+-- Logical Volume Group D3D788DF-C76A-43B9-8325-A8E875E3720A
|   =========================================================
|   Name:         Seagate1
|   Status:       Online
|   Size:         10000007168 B (10.0 GB)
|   Free Space:   782336 B (782.3 KB)
|   |
|   +- Logical Volume Family AAFDF6DC-ECEE-4919-9FD9-A3A6E3F1CCEF
|       ----------------------------------------------------------
|       Encryption Status:       Unlocked
|       Encryption Type:         AES-XTS
|       Conversion Status:       Complete
|       Conversion Direction:    -none-
|       Has Encrypted Extents:   Yes
|       Fully Secure:            Yes
|       Passphrase Required:     Yes
|       |
|       +-> Logical Volume B5EA0F9F-55D6-48BF-BBD0-FBA00B595D6F
|           ---------------------------------------------------
|           Disk:                  disk3
|           Status:                Online
|           Size (Total):          9646899200 B (9.6 GB)
|           Conversion Progress:   -none-
|           Revertible:            No
|           LV Name:               Seagate1
|           Volume Name:           Seagate1
|           Content Hint:          Apple_HFS
|
+-- Logical Volume Group 31EFE91B-0384-4D1F-B706-493509FBC66F
    =========================================================
    Name:         Seagate2
    Status:       Online
    Size:         10000007168 B (10.0 GB)
    Free Space:   19005440 B (19.0 MB)
    |
    +- Logical Volume Family E5AFD11D-75E5-4ACB-8687-D740C1ED99AC
        ----------------------------------------------------------
        Encryption Status:       Unlocked
        Encryption Type:         AES-XTS
        Conversion Status:       Complete
        Conversion Direction:    -none-
        Has Encrypted Extents:   Yes
        Fully Secure:            Yes
        Passphrase Required:     Yes
        |
        +-> Logical Volume 31DE3F9A-F7FD-4898-B3D7-C9222D38B943
            ---------------------------------------------------
            Disk:                  disk4
            Status:                Online
            Size (Total):          9628680192 B (9.6 GB)
            Conversion Progress:   Complete
            Revertible:            Yes (unlock and decryption required)
            LV Name:               Seagate2
            Volume Name:           Seagate2
            Content Hint:          Apple_HFS

Best Answer

The difference with method 1 is that, with method 1, you're not actually converting anything. You're erasing the existing data and replacing it with an encrypted partition. With method 2, a conversion process begins, which doesn't erase data, but does take more time.

The thing to keep in mind: any drive which is converted from a normal drive (HFS+) to a Core Storage drive can be reverted back to a simple HFS+ volume (non-encrypted). If you use the Disk Utility method you showed above, the resulting disk will NOT be revertible, because the disk will have never been an HFS+ volume in the first place. That is what you're seeing with "Revertible: No". If you use the Finder method (or the equivalent command-line option), the drive will be revertible.

Another thing to keep in mind is that modern versions of OS X will normally use Core Storage on the boot drive by default, even on unencrypted disks. The result is that, in some cases, "Revertible" may always be "No". You'll always be able to decrypt a Core Storage volume however, so perhaps this is insignificant for most people.

If you want to talk about what's the best option for Time Machine, it doesn't really matter. The end result is, in either case, an encrypted disk, protected by a password. To do anything to the disk you would need the password. There isn't any significant difference to either method. It's marginally possible that the disk utility method could be the slightest bit more secure, for the simple reason that this reduces the number of attack vectors. If there is any benefit, it would only be slight.

Related Question