APFS Sparse Bundle Encrypted images on HFS+ HDD

Question

Level 1

4 points

APFS Sparse Bundle Encrypted images on HFS+ HDD

I just bought a new LaCie with 40TB and I noticed I can't format it as HFS+ Encrypted anymore (using Ventura). Because it's a mechanical hard drive I am not comfortable using APFS after all I read a few years ago and also this week. I already have APFS on other external hard drives and I noticed with time they slow down, specially when I am comparing copies (with File Info or diff).

I use large amount of data and move many files around all the time. Sometimes large files (audio and video), sometimes lots of small files (node_modules and active Git repositories, for instance).

I would like my RAID 1 array to be encrypted. I am wondering if it's safe to format it with HFS+ then create a Sparse Bundle file encrypted. I am afraid that because there will be so many small files performance can be affected or even worse, if some of those files gets corrupted, the whole disk image will be lost.

Is it safe to use very large Disk Images (20 TB)?
Would it be be better to break the root disk image into several smaller ones? It might be annoying because more disk images to mount every time I mount the hard drive itself, but maybe less blast radius.
Would it be safer to use sparse disk image instead of sparse bundle disk image? Assuming encryption will always be used.
Could it be safer to use read/write disk image (not sparse)? I will never save anything outside the disk image.
How would it perform if I use APFS for a 20TB disk image (sparsebundle and sparsedisk) saved in a HFS+ HDD? I would like to take advantage of the normalisation and UFT-8 on APFS, but if using APFS on the disk image would bring the drawbacks of APFS on HDD then I am ok with using HFS+ just to encrypt the folders. — Context: some files I used had special characters (japanese, emojis, accents of Portuguese language etc) and using rsync I realise they always are seen as changed and those uncommon characters display differently on HFS+ than on APFS on Finder and sometimes on iTerm 2.

Thanks a lot!

MacBook Pro 15″

Posted on Jun 23, 2023 3:20 AM

Reply

Answer 1

Barney-15E

Level 10

123,320 points

Jun 23, 2023 5:12 AM in response to thiago297

I use large amount of data and move many files around all the time. Sometimes large files (audio and video), sometimes lots of small files (node_modules and active Git repositories, for instance).

That is a good reason to not use APFS on a spinning hard drive.

1. I would like my RAID 1 array to be encrypted.

This is a RAID device? That's not clear initially except the fact that it is 40TB.

Does it not come with some RAID management software that would encrypt it for you?

I am wondering if it's safe to format it with HFS+ then create a Sparse Bundle file encrypted. I am afraid that because there will be so many small files performance can be affected or even worse, if some of those files gets corrupted, the whole disk image will be lost.

I'm not sure about any of the rest of it, but I imagine you are correct about the Sparse Bundle slices. It doesn't reserve the space ahead of time, so all of the slices would be fragmented all over the drive. Even a regular disk image does not reserve any space. It grows dynamically (does not shrink) as more space is needed.

Do you have an older Mac you could use to configure it. I think you have to go previous to Big Sur to have CoreStorage available to encrypt HFS+. It will be useable on your Mac, you just can't configure it. It is quite possible some future macOS would drop all CoreStorage support.

Reply

Answer 2

thiago297 Author

Level 1

4 points

Jun 23, 2023 5:04 AM in response to Tom Gewecke

My message was closed so quickly on the Stack Exchange! I don't consider it was a duplicate because mine focus on disk images instead of APFS vs HFS+ debate, and the few questions that talk about disk images discuss small images and do not focus on sparse/non sparse.

I can't edit my message here to simplify it, but I will try here in the comments:

Simplified question:

macOS is no longer allowing me to use HFS+ encrypted for external disks. Is it safe to create a 20TB encrypted disk images on a HFS+ formatted mechanical hard drive?

If so, can I use APFS encrypted or should I keep HFS+ encrypted? — I can't confirm using APFS encrypted disk images on a HFS+ mechanical hard drive will remove the drawbacks of using APFS on mechanical disks.

Subquestions:

1. Should I use sparse disk image, sparse bundle disk image or no sparse (read/write disk image)? I will never save anything outside the disk image, so using up 20TB even in the beginning is ok.

2. How would it perform if I use APFS for a 20TB disk image saved in a HFS+ HDD? I would like to take advantage of the normalisation and UFT-8 on APFS, but if using APFS on the disk image would bring the drawbacks of APFS on HDD then I am ok with using HFS+ just to encrypt the folders.

Thanks a lot!

Reply

Answer 3

thiago297 Author

Level 1

4 points

Jun 23, 2023 8:12 AM in response to Barney-15E

On this device you control the RAID settings using an app but I believe the RAID controller is in the hardware. So once RAID is set I had to initialise the disk using Disk Utility. I used HFS+ (unencrypted).

I did what you suggested on my previous hard drive (used an old macOS to reformat it with HFS+ encrypted). That drive became too small (8TB), which is why I bought a new one and have to migrate the data (40TB, but with RAID it became 20TB). Because Apple has disabled HFS+ encryption for a few macOS versions now, I was hesitant to do the same now. Maybe they will soon stop using CoreStorage. I don't want to depend on old macOS. What if I need to restore something, change password, etc.?

So that made me think about the disk images, which I usually use to archive small folders, but never used for large files. I know Time Capsule successfully uses the bundle, but the read and write usage is very different as well.

Reply

Answer 4

Barney-15E

Level 10

123,320 points

Jun 23, 2023 9:16 AM in response to thiago297

TM does use a Sparse Bundle, but it was designed to be TM-aware. Since only slices change, TM would only back up the changed slices and not the entire image.

The use case with Time Machine is very different than how you will be using it. Seems like a lot of risk being the guinea pig.

Reply

Answer 5

Jun 26, 2023 1:03 PM in response to thiago297

If you don't mind using a third party app, then you may want to consider using Veracrypt (forked from the old TrueCrypt project). I haven't used Veracrypt although I know people who used to use TrueCrypt. I don't recall any issues, but they also did not use the macOS version.

https://www.veracrypt.fr/code/VeraCrypt/

Reply