Creating a 'dirty' a locked APFS volume next to another (main APSFS volume) that can't be seen locations and is not accessible.

Question

Level 1

4 points

Creating a 'dirty' a locked APFS volume next to another (main APSFS volume) that can't be seen locations and is not accessible.

I sometimes have to work in an unsafe environment and would like to create a kind of 'dirty volume' and keep my main volume safe.

I did this but the drive actually shows up in my locations and I can access the folders without any password or anything. So that makes this whole idea useless.

When I boot from that volume I want it to show up as the only volume and in no way be able to access the folders of my main (safe) startup volume.

I think what describes it best is creating a sort of sandbox. Meaning that anyone who can access the dirty volume can do anything to it and install stuff behind my back (even if they know my admin pasword) but would never get anywhere once I boot up my safe volume again.

Any ideas?

Working in VENTURA

Posted on Dec 12, 2022 6:15 AM

Reply

Answer 1

xnr Author

Level 1

4 points

Dec 13, 2022 9:19 AM in response to xnr

I think I've found a solution; If you create a separate APFS volume running OS, you should encrypt it and turn on filevault. When you unmount the volume, it won't be shown in locations. Then just make sure that volume's password is not stored in your keychain. When you try to mount it you can only do so by entering the password. Furthermore in recovery mode (command r) make sure you have your firmware password on and have top security on your volumes. Also install an app locker and use it for your keychains, terminal, etc - and again: do not store that password in your keychain. Off course in your system settings only allows mac os software to download. Then create an admin and user account and make sure your user account doesn't have admin permissions and work from the user account.

What do you think? Good idea?

If anyone knows how to bypass this system please let me know :)

Reply

Answer 2

Dec 12, 2022 10:18 AM in response to Grant Bennet-Alder

For direct keyboard access, you can lock the screen (requiring re-entry of the password) after screensaver starts or nnn minutes of inactivity.

for Monterey and earlier:

Require a password after waking your Mac - Apple Support

For Ventura and later:

Require a password after waking your Mac - Apple Support

You can invoke a screensaver quickly (and lock your keyboard) just by moving the cursor to a hot corner.

If you have an Apple watch, you can also use your close proximity as the unlock key.

Reply

Answer 3

Dec 13, 2022 6:21 PM in response to xnr

This was posted in a nearby thread, and I thought of you.

It concerns wanted and unwanted Sharing more than viruses and malware. You might want to take a look:

Personal Safety User Guide - Apple Support

Reply

Answer 4

Dec 12, 2022 8:19 AM in response to xnr

As a compromise, how about booting from a separate system on an external drive?

Reply

Answer 5

Dec 12, 2022 7:45 AM in response to xnr

xnr wrote:

(even if they know my admin pasword)

Seems a unrealistic/bad idea...

For your spycraft it seems having a throw-a-way computer/with a throw-a-way account would be more appropriate.

Add, delete, or erase APFS volumes in Disk Utility on Mac

Reply

Answer 6

xnr Author

Level 1

4 points

Dec 12, 2022 8:11 AM in response to leroydouglas

It's not my spycraft btw... I'm the victim here. I just don't want my machine to be compromised AGAIN.

A 'dirty' machine is kind of a hassle. Is there no other way around it?

And If I get a 'dirty' machine. Then it should never ever connect to my home network right? Or I will be compromised again?

All tips are welcome.

Reply

Answer 7

xnr Author

Level 1

4 points

Dec 12, 2022 8:43 AM in response to Grant Bennet-Alder

Yes, that may be an option.

Maybe this dumb question but I'm little rusty here.

Is it still possible to boot from a usb stick using an APFS volume? And if I boot up from a usb stick or external hdd

will all my folders and keychain of the main volume still be accessible in locations?

Because that's the part I'm worried about.

I just want to be able too pee and not have to bring my mac to the toilet with me :)

I'm dealing with someone I know and love but who's a complete freak and willing to go to great lengths

to access ALL my private data and my network and who has the skillset to do that.

Reply

Answer 8

xnr Author

Level 1

4 points

Dec 12, 2022 9:15 AM in response to Grant Bennet-Alder

The problem is that I have a mac I need to work on in an environment with someone who will go to great lengths to obtain my personal data. You could possible describe this person as a sociopath or a personal data addict and I am (one) of this persons targets. That specific person is in charge of the wifi network too.

However this is someone I love, so I will not go to to the police or any stuff like that. And yes, you may describe me as a freak too for not doing that - but it's my choice, please respect that. However I want this to stop and protect myself at all cost from this person accessing my data. What are my best options?

Reply

Answer 9

Dec 12, 2022 10:12 AM in response to Grant Bennet-Alder

Best Practices concerning Wi-Fi networks requires that you enable encryption using a modern standard such as WPA-2 or similar. Once you do, every packet you send out and even packet that comes back is encrypted, and is extremely difficult to hack for any personally-identifiable information.

Your Mac should have a login password. Anyone else who needs to use your Mac should her a separate User-level (not Admin-level) account of their own, and not use your account for anything.

Reply

Answer 10

Dec 12, 2022 10:33 AM in response to Grant Bennet-Alder

Since MacOS 11 Big Sur, the Mac now keeps the invariant part of the System on a separate, signed, checksummed, locked System volume, so as to be inaccessible for hacking. It can not easily be changed without at least being detected, and that usually brings your Mac to a halt.

That means added "stuff" that a hacker might have placed on your Mac has to be in its own files (not patched into system files) and those files can be detected.

A little 'discovery' Utility named Etrecheck was developed by a senior contributor on the forums for researching what might be causing poor performance, slowdowns, or crashing on user's Macs. its report will clearly show things that have been added to your Mac, so that you can find any added malware such as a key-logger.

Its report is created 'pre-laundered' of any personally-identifiable information, so it can be freely posted back to the forums, if you need additional help identifying trouble spots. Even the names of your drives are obscured, except for the default Macintosh HD.

Using EtreCheck to Troubleshoot Potential… - Apple Community

.

Reply