Mountain Lion, FileVault 2 and Encrypted Backup Drives

[Kampernaut]

I experimented with FV 2 on Lion with and unencrypted external drive and it worked fine.

Now I want my external backup drive encrypted too.

I've found over 100 threads on encryption in this forum and my head is spinning now. Hopefully you can help me clear up my remaining confusion.

1. If encrypt my external backup drive, will I be able to boot from it or not?

2. If I understand correctly, I must first reformat my external drive to have encrypted contents. However what format should I choose: the normal or the case sensitive version?

3. What passphrase should I use for the encryption? Is it the same as the one I used for FV 2 or should it be different? If the latter why?

4. When will I be prompted for the external backup drive's passphrase? If the clone is bootable, will it be when I select it as the startup volume?

5. If you accidentally disconnect an external encrypted drive without ejecting it properly first, is there any extra risk introduced by the encryption compared with improperly detaching a normal one?

6. Generally with FV2, must I shut down the computer to get the disk encrypted or sleep enough (lid shut on a MacBook Pro)?

7. Apart from the risk of forgetting the password to your encrypted backup, is there any reason you wouldn't encrypt it?

Thanks

K

[dnanian]

1. In our test, we can boot from it. I suggest repairing the result with Disk Utility and using the startup disk preference pane to select it for boot.

2. Whatever the source has (likely normal).

3. Your choice. I'd use the same.

4. Same as the source.

5. I have no way of answering that. It's *ALWAYS* a terrible idea, though.

6. The drive is always encrypted.

7. I think an encrypted backup is much less 'recoverable' should you have drive, directory or other issues, since the data isn't easily scanned. So, personally, I avoid encryption.

[Kampernaut]

Thank you for such a prompt, comprehensive and helpful reply — as usual :)

[Timmy]

Is there a definitive FAQ or step by step guide for cloning a FileVault2 boot volume with SuperDuper! so that the resulting clone is encrypted and bootable?

I don't see anything in the SD! manual about FileVault2 and as the OP mentioned there are dozens of disparate threads in the forum...

[Kampernaut]

Hi Timmy,

There isn't much to it really. All you have to do is use OS X Disk Utility to create an encrypted partition on your backup drive. Obviously you must choose a strong, memorable password using something like DiceWare or a random password generator tool like 1Password. I favour the latter personally. Whatever you do, it is very important that you eliminate any risk of forgetting that password otherwise the backup is useless.

After that, once the partition is mounted in OS X it just looks like another drive to SuperDuper and everything works just the way it normally does.

OS X gives you the option to remember the password for the drive in the OS X keychain so you aren't continually prompted for it each time you connect it to the computer you are backing up. Of course not having to type it frequently enhances your chance of forgetting the password unless you use something like 1PW.

Hope that helps.

K

[Timmy]

Would the instructions above produce a bootable clone?
I don't see how it could since there is no mention of a Recovery Partition which from what I understand is required to boot a FileVault2 system.

[dnanian]

Please give it a try and let me know if it works for you.

[Timmy]

Please give it a try and let me know if it works for you.

I'm not one of your software testers.