File Vault after moving to new MBP

WillWheaton wrote:

I've read that filevaults moved from an old mbp to a new one requires that you turn it off, let it decrypt, and then turn it back on again to get a new recovery key (either in the iCloud account or not). And if you don't, then your old recovery key for your old mbp is orphaned, which include time machine backups as well. So I am trying to be duly diligent by keeping up with that.

FileVault is bound to each particular Mac. It only protects the data that lives inside the Mac. Once any of that data is moved outside of that particular Mac (example: to an external drive for Time Machine backups), it is outside FileVault's scope of protection, and is decrypted on the fly.

You can't transfer FileVault itself to another Mac, but you can transfer the data from one Mac to another, and then enable FileVault on the new Mac :)

In regards to the rest of your question, enabling or disabling FileVault is now instantaneous on any Apple silicon Mac (M1 and future), or any Intel-based Mac with the T2 Security Chip. As mentioned by HWTech, your data is actually already encrypted by the Secure Enclave, but enabling FileVault provides better security by tying the encryption keys to your password. Without your password or the recovery key, your data is inaccessible when FileVault is enabled.

For the diskutil list output: FileVault is enabled. However, the situation may seem confusing, when another piece of that output says that the volume isn't encrypted. Let me explain.

In macOS Big Sur and later (including macOS Monterey), your Mac uses two important volumes: The Signed System Volume (SSV), and the Data volume.

• The SSV (usually "Macintosh HD") contains the vast majority of macOS, including most preinstalled apps. It is cryptographically sealed, and the seal is checked against a signed value provided by Apple. Whenever you start up your Mac, it boots from an immutable snapshot of the SSV. This ensures that your Mac always starts up from a perfect copy of macOS. With these strong protections in place, it isn't necessary to encrypt the SSV with FileVault, and it actually remains decrypted even with FileVault enabled. If the SSV is modified in any way (except by macOS updates), your Mac will refuse to start up, and it will prompt you to reinstall macOS. SSV protections are always active, even if FileVault is disabled.

• The Data volume contains all of your data, apps, and settings. FileVault encryption applies to this volume.

The diskutil apfs list output that you provided describes the SSV, not the Data volume. To verify that FileVault is enabled and the Data volume is encrypted, run diskutil apfs list again, and check the details for "Data" or "Macintosh HD - Data".

The 2018+ Macs always hardware encrypt the data stored on the SSD. Filevault on the 2018+ Macs is different than on older Macs. Filevault for the 2018+ Macs now just add an extra layer of security by requiring a password to unlock the drive. Here is an Apple article with the information:

About encrypted storage on your new Mac - Apple Support

Great to hear - glad I could help! It looks like FileVault is indeed enabled for the Data volume. And yes, it is showing as "Unlocked" since you've signed in to the Mac :) It will remain unlocked until you shut down or restart your Mac.

If you ever need to start up from macOS Recovery (shut down your Mac, then hold down Touch ID until prompted), running "diskutil apfs list" from Terminal in there will show the Data volume as locked. It will remain locked until you explicitly unlock it (by mounting it in Disk Utility).