Disk Encryption Questions

Hello,

1) Maybe. In the past, I used to do this all the time. I would boot from an external hard drive, format the internal as HFS/APFS encrypted, and install the operating system. When setting up the first user after install, there would be a checkbox to give that user unlocking privileges and I would be all set. In some cases, I used the fdesetup tool from recovery to remove an extra “unlock” user at boot up.

However, this process does not seem to work with Mojave. At least, I had trouble with it and did it the “official” way. On High Sierra, it should still work. Just remember that this procedure is really only safe with a new hard drive. If you had unencrypted data on the drive before, it will still be there and still be unencrypted. It appears that the “official” way will encrypt all free space too, effectively doing everything it can to make the drive secure, within the limits of the media.

2) Formatting an SD card as APFS encrypted shouldn’t adversely affect its performance. An SD card is already pretty slow. The CPU should have no problem staying ahead of the media while encrypting or decrypting. Using an SD card may make those apps slower than they could otherwise be.

Hi Nick,

Format the target disk "Mac OS Extended (Journaled)" - but not encrypted.

Install macOS Sierra on the fresh, unencrypted disk.

Finally, turn on disk encryption (called FileVault). This can be done near the end of installing Sierra (it prompts you if you want encryption), or after the install is done. Either way is fine.

On #2, what is the R&W speeds of it? If there is a speed for constantly encrypting/decrypting diff I think an Encrypted Disk Image might solve that by only needing theb key when mounting it.

Great, good luck Nick.