Restoring a Time Machine Backup on an Ecrypted Drive in Recovery Mode

Still only one layer of encryption being applied here. Considering that you formatted the drive as encrypted in Disk Utility, if you unchecked the option for encrypted backups in the Time Machine setup process, macOS would have started decrypting your backup drive immediately (and unless you erase it, that takes a long time to complete).

Regarding Time Machine System Restore, I think the setup flow looks something like this:

1. You launch the app in macOS Recovery and go past its welcome screen.
2. Select the backup drive and unlock it if necessary.
3. On the next screen, select the backup you wish to restore (by startup disk and date).
4. On the final screen, choose which internal partition to erase and restore the backup contents to. The “Continue” button on this screen is changed to “Restore” I think.

Also, if you were to use the app to roll back to a Time Machine local snapshot, step 4 is skipped (the startup disk or data volume that hosts the snapshot is implied), and a final warning appears instead. Snapshot rollbacks take less than 10 seconds to complete once started, whereas real backup restores can take hours (since external content has to be transferred in).

Hi eoinwalsh,

On an external drive, formatting it as encrypted in Disk Utility and checking the "Encrypted Backups" checkbox both do the same thing. They encrypt the partition that holds the backups. In your case, you're ok - there's only one layer of encryption being applied here.

The Time Machine System Restore app (Restore from Time Machine in macOS Recovery) should be able to unlock an encrypted backup drive with no issues. If you want to test this, follow these steps:

1. Start up from macOS Recovery: Hold down Command-R as you power on or restart your Intel-based Mac. Release the keys when the Apple logo and a progress bar appears.
2. When the list of utilities appears, select Restore from Time Machine.
3. Follow the onscreen instructions until you're prompted to confirm the restore. At that point, you can cancel the process. During the setup phase, you should be prompted to provide the password to unlock your encrypted backups.

In Recovery Mode, Disk Utility is available and can be used to mount drives, including encrypted drives (which will prompt for password). You may need to select > View > Show all Devices in DU to see the connected drive.

Note that in general, double encryption is both unnecessary and undesirable. Not sure why you'd encrypt an external drive, then use TM's encrypt backup option as well. If there's time, you may want to create a fresh backup with only TM encryption.

Personally, for my four in-home Macs in addition to TM backups on a 20 TB NAS, I use a pair of 5 TB external drives to swap out as offsite backups. On those APFS-formatted drives I have five volumes, four that are unencrypted but used for TM backups (with encryption) of the four Macs, and a 5th volume that is encrypted (using DU) for general file storage.