Protecting (Encrypting?) A Cloned Drive

[qamera]

I use Super Duper to create a bootable backup on an external 2.5" drive. The drive travels with me, so in case the drive on my MacBookPro fails, I can simply boot off that without skipping a beat. However, it occured to me that if I were to lose my briefcase or if that drive were to fall into someone's hands, they could easily access all the information. Is there a way to protect a bootable backup drive, both for authentication and encryption?

(As I'm writing this I'm thinking, the solution is probably to just use File Vault?)

[dnanian]

FileVault has its own downside, actually, since it means your backups will be much slower, and will need to be done from a non-FV account...

[jeremy_m]

Dave, is this info about File Vault still true in 2012 with the latest version of SD? I feel it's time for me to amp up my security, and am considering FV. I'm not opposed to a longer backup time and logging out and into a non FV user -- I log out and log back in with the shift key down to stop background processes anyway. Are there other other things I should be considering about File Vault do you think? Thanks! ~ Jeremy

[dnanian]

No, FileVault 2 is handled entirely differently, and you need not log out when backing it up.

Note, though, that if you want an encrypted backup, you'll have to format the destination encrypted with Disk Utility, then Smart Update to it.

[astrodog]

Can you then boot from the encrypted volume??

[dnanian]

You should be able to. Try with the startup disk preference pane first.

[jeremy_m]

Note, though, that if you want an encrypted backup, you'll have to format the destination encrypted with Disk Utility, then Smart Update to it.
Dave, does this mean I should create a password-protected sparse disk image? I guess I don't understand what an "encrypted destination" is, sorry. I do need the backup to be bootable as well, as astrodog mentions.

I've read the SD! manual for FileVault info, and there isn't much -- I can't get a version date on the manual I'm using, but it still recommends logging into a non-FV user to do the backup, so I guess the manual hasn't been updated for FV2 stuff as you mention.

I've always stayed away from FileVault because of all these complications, but I now have SD! clones scattered around the globe, and I don't want wandering eyes on my data, so I thought I should explore FV again.

[astrodog]

You can encrypt an entire volume (done at format time in Disk Utility) - have a look in DU, click erase - its one of the format options. Encrypted disk images aren't bootable, I've never tried to boot from my encrypted drive....

[dnanian]

astrodog is correct, here - just format the destination volume as encrypted and back up directly to it, no image needed.

[jeremy_m]

Thanks Dave and astrodog,

So, I turn on FV2 on my internal boot drive, then create encrypted partitions on my externals, and SD! smart update those encrypted partitions. This seems to be the workflow then.

I've done a little digging and it looks like FV2 encryption slows down performance by something like +/- 20% in some cases, I guess I can live with that... IF ... the clone is actually bootable. Now, the fine print on booting from a FV2 volume seems to involve Lion's new Recovery Drive.

My question now is does SD! "Backup - All Files" with Smart Update clone Lion' Recovery Drive so I can boot from a clone of my FV2 volume on an encrypted partition on an external drive?

[dnanian]

Yep. Booting shouldn't require a recovery partition. Again - try with the Starutp Disk preference pane and I think you'll find it'll work.

[jeremy_m]

Super, thanks!