Since my primary hard disk is encrypted with FileVault2, I also wanted my backup drive to be encrypted. I plugged in my external drive, brought up Disk Utility, and went to erase/format the disk. I chose Mac OS X Extended (Journaled, Encrptyed). However, I couldn't find out what kind of encryption it uses. Does anyone know (and/or know how I would look this info up via a command or system utility)? Is it the same as FileVault2?
What kind of encryption does Mac OS X Extended (Journaled, Encrptyed) use
disk-utilityhard drive
Related Solutions
I'd say this is more work than it's worth since Lion clearly isn't expecting to be able to deal with the new encryption scheme. You'd be better off running Lion virtually as that's far less work to do than hacking together the parts of Mountain Lion needed for file vault 2.
The obvious catch-22 is where you need to expose that disk to Lion to get it encrypted in the first place, the recovery HD placed on that drive will allow the installer to prompt for a password and get the CoreStorage keys set up to unlock that volume for the installer.
As mentioned in the comments, it's easiest to connect your encrypted Mac to another Mac in target disk mode to get the Lion installer to run (or better to just image things) - but advanced knowledge of fdesetup and the boot process also might allow other solutions. You will likely have continual problems with automatic rebooting since Lion isn't going to know how to decrypt the boot volume nor will the Recovery Boot image want to hand off to Lion since it's not supposed to know how to handle Filevault 2 drives in the first place.
This is an example of a procedure to erase an external disk containing a single encrypted partition.
Open the Disk Utility application and highlight the "Logical Volume Group" representing your external disk. An example is shown below. (Hint: click on image for a better view.)
Next, click the Info icon to get the pop up window. Note, in the example shown below, the "Physical Backing" is disk1s2. This means the physical disk number is 1. The "s2" suffix can be ignored. Your numbers may be different.
Next, highlight the "Encrypted Logical Partition" as shown in the example below.
Again, click the Info icon to get a pop up window. Note the "Disk Identifier". In the example shown below, the value is disk2. Your value may be different.
Close the Disk Utility and open the Terminal application. Enter the following commands. If your numbers differed from mine, make the appropriate substitutions. If prompted, enter your login password.
diskutil unmountDisk /dev/disk2 sudo gpt destroy /dev/disk1 sudo gpt create -f /dev/disk1When I entered these commands, I saw the following in the Terminal window.
Steelhead:~ davidanderson$ diskutil unmountDisk /dev/disk2 Unmount of all volumes on disk2 was successful Steelhead:~ davidanderson$ sudo gpt destroy /dev/disk1 Password: Steelhead:~ davidanderson$ sudo gpt create -f /dev/disk1 Steelhead:~ davidanderson$The
distutilcommand must successfully unmount the disk in order for the gpt commands to work. If the disk will not unmount, then some window needs to be closed. Do not proceed with the gpt commands, if you can not unmount the disk.If successful, you should see a result similar to what is shown below. The result shown is a 4GB flash drive with no partitions. You can either add a partition or repartition the entire drive.
Related Question
- Formatting Boot Drive As Encrypted For Clean Install
- Encrypt external HDD without erasing data on High Sierra
- External hard drive encryption using Disk Utility
- How to clone from a Mac OS Extended (Journaled) spinning hard drive to a new SSD on 10.13.6
- How to Downgrade from MacOS Catalina to Mojave- Creating a bootable hard drive in APFS format
- MacOS Catalina – Spotlight Search Problem with External Hard Drive Mac OS Extended (Journaled)
- Mac – How To Change Time Machine Password – Mac OS Extended (Journaled, Encrypted)
Best Answer
Yes - it's the same whole disk encryption. In both instances you end up with a volume wrapper and key storage to unlocks the encrypted file system where the data is safely stored. Disk Utility is a bit of a chore to set up encryption of an external drive, so I usually just wipe the drive and set it for Backups and then tell Time Machine to encrypt the drive. It handles the formatting, generating the crypto keys and lets you choose a passphrase to unlock the keys.
You can use
diskutil cs listfrom the command line (in terminal.app) to show the encryption status and details. There's nothing wrong with disk utility other than the steps involved to reach an equivalent drive setup.Here is what a fully encrypted and locked USB drive looks like when you set up Time Machine and instruct it to encrypt backups to an external drive: