Time Machine and File Vault

Hello, everyone. I need a little help understanding how Time Machine and File Vault are supposed to work together and I hope the folks here can help me out.

They don't play well together, unfortunately. Time Machine will only back up your FileVault when you log out. If you don't log out, you don't get backed up.

My company requires me to have File Vault enabled

You may want to talk to them about letting you put sensitive files in an encrypted disk image instead. FileVault is major overkill for most people, and a source of all kinds of potential problems and hassles.

Recently I had the need to restore a couple of files from my TM backup

Unfortunately, that is not a possibility when you use FileVault. Time Machine can only restore an entire home folder when you're using FileVault. It cannot access individual files within the backup.

Thomas A Reed wrote:
Time Machine can only restore an entire home folder when you're using FileVault. It cannot access individual files within the backup.

Are you sure about that? I'm skeptical, but I'm not running FileVault anymore so I can't verify.

I can definitely say that you can restore individual files, even if you can't do it through Time Machine. Just open the backup sparse bundle file in the Finder, enter your password, find your files, and copy them out.

Here's another source:

http://www.macosxhints.com/article.php?story=2007111404402514

It does confirm what you say that you can access your FileVault backup in the Finder, though it should be noted that messing with Time Machine backups in the Finder is dangerous... if you change anything, you break the whole thing.

Also, #9 on the [Time Machine FAQ|http://discussions.apple.com/thread.jspa?threadID=1964018] should be considered when backing up a FileVault.

etresoft wrote:
. . .
I can definitely say that you can restore individual files, even if you can't do it through Time Machine. Just open the backup sparse bundle file in the Finder, enter your password, find your files, and copy them out.

That's certainly not easy, or recommended. You may have permissions problems with the copied files, especially in a multi-user setup. Time Machine puts very restrictive ACLs on the backups.

Thomas A Reed wrote:
it should be noted that messing with Time Machine backups in the Finder is dangerous... if you change anything, you break the whole thing.

Bah! I do it all the time.

Pondini wrote:
That's certainly not easy, or recommended. You may have permissions problems with the copied files, especially in a multi-user setup. Time Machine puts very restrictive ACLs on the backups

Again, Bah! It's easy and I do it all the time.

etresoft wrote:

Pondini wrote:
That's certainly not easy, or recommended. You may have permissions problems with the copied files, especially in a multi-user setup. Time Machine puts very restrictive ACLs on the backups

Again, Bah! It's easy and I do it all the time.

There are any number of posts here by folks who've had all sorts of troubles with things copied from their backups. If it works for you, great! But for many others, perhaps less sophisticated, it doesn't.

Bah! I do it all the time.

You doing it all the time and advising someone else to do it are two different things. The dangers of messing with Time Machine backups in the Finder are not imaginary.

Pondini and Thomas,
Do you have any better suggestions that Michael could use to restore his two files? If so, I'm sure he would love to hear them. If not, I'm sure he knows by now not to muck around in there any more than he needs to.

etresoft wrote:
Pondini and Thomas,
Do you have any better suggestions that Michael could use to restore his two files? If so, I'm sure he would love to hear them.

If we did, don't you think we would have mentioned them already?

+File Vault+ makes an encrypted disk image of your home folder; that's what is saved when you log out.

When you log on it's decrypted; that version is not saved by Time Machine, of course, as that would defeat the whole purpose of encrypting it.

Encrypted or not, you cannot get at the contents of a disk image without opening it.

Perhaps you missed Thomas's first post:

Unfortunately, that is not a possibility when you use FileVault. Time Machine can only restore an entire home folder when you're using FileVault. It cannot access individual files within the backup.

I think we've already covered the options. Either restore the entire user account using Time Machine, which is safe but extreme for recovering a couple files, or dig around in the backup using the Finder, which is more convenient but unsafe and may not give the expected results in inexperienced hands.

I am new to Mac OS X and have been experimenting with File Vault and Time Machine. It seems to me that TM only keeps the latest version of the encrypted Home folder, and does not have different versions of backup going back in time. Is this how TM is supposed to work with File Vault? If yes, and I delete a file - will it be deleted from the backup next time user logs out and TM backup is run?

Dimitri B wrote:
I am new to Mac OS X and have been experimenting with File Vault and Time Machine. It seems to me that TM only keeps the latest version of the encrypted Home folder, and does not have different versions of backup going back in time. Is this how TM is supposed to work with File Vault?

No. Each time you log out, TM should back up the encrypted version of your home folder (unless you cancel it). Other backups may occur while you're logged-on, or while a different user is logged on, but your home folder will not be backed up then -- those backups will show the "sparse bundle" containing your home folder as it was the last time IT was actually backed-up.

You cannot see inside the sparse bundle via Time Machine, but each one that's actually backed-up is different. If you select your internal HD, then +Enter Time Machine,+ and browse your backups, you'll see the sparse bundle in your user account for each backup. The +Date Modified+ should be different for each time the sparse bundle was backed-up, but not when it wasn't.

Backups done at other times, while you were logged on, or while a different user was logged-on, will show the previous, unchanged version.

If yes, and I delete a file - will it be deleted from the backup next time user logs out and TM backup is run?

It won't be included the next backup of course, but the previous versions of the sparse bundle will remain on your system for a time. That varies, as TM periodically deletes backups. See #12 in Time Machine - Frequently Asked Questions (or use the link in *User Tips* at the top of this forum).

You may wish to investigate LBackup as a possible option for backups of user home directories have file vault enabled.

Further information regarding LBackup is available from :
http://www.lbackup.org for further information.