Understanding encryption using Disk Utility

See: http://en.wikipedia.org/wiki/OTFE

guy toronto wrote:

. . .

But is it being decoded (ie is the underlying file is always encrypted)?

Yes.

If I make a copy of a file (after password entered), is this copy encrypted?

Depends on where you put it. If you copy it to an unencrypted volume (actual disk/partition or disk image), no.

If I make a back-up using Time Machine, are the back-up files (of encrypted files) encrypted?

No (unless the backup drive is also encrypted).

Also note the contents of the disk image will not be backed-up while its mounted.

In both cases, because it's unencrypted "on the fly."

If you copy or back up to an encrypted volume, it will be re-encrypted.

Think of it this way. The encrypted disk image that you created is always encrypted. When you click it (open it), you are asked for a password and then a Volume is mounted by decypting the disk image. The mounted volume is unencryped, and any files that you move/copy from the Volume will remain decrypted. If you maked changes to the files within the Volume, or add files to the Volume, once the Volume is Ejected, the disk image will be updated, and encrypted)

I don't use Dropbox, but I think I've heard they encrypt everything. If so, then yes, those backups will be encrypted (separately).

Entering the password for the encrypted disk image on your Mac won't expose the Dropbox copies; they're entirely separate and will presumably have their own password.

Wouldn't matter if Dropbox was not encrypted. The disk image (that resides on DropBox) is always encrypted. When the image is clicked and opened with a password, the disk image remains encypted. The unencrypted Volume is attached to the Mac filesystem, and only "seen" there.

Using the same logic, wouldn't the Time Machine back-up (of an encrypted disk image) also remain encrypted? Pondini seems to suggest that this is not the case.

What I think he means is, if the Volume is backed up to Time Machine, it won't be encrypted, but a mounted Volume from a Disk Image is not backed up to Time Machine, so I'm not sure what he means. The actual Disk Image (that is backed up to TM) is always encrypted.

Finally, on a slightly different note (not sure if it's better to start a new question) ... how could I get to a similar result for emails (server is iCloud)? Ideally, I would want all the emails I store on iCloud to be encrypted. Is this doable?

Apple has stated that anything in iCloud is encrypted (iCloud: iCloud security and privacy overview), so it comes down to if you trust Apple (could they have the key to your encrypted data?)

Tony T1 wrote:

. .

What I think he means is, if the Volume is backed up to Time Machine, it won't be encrypted, but a mounted Volume from a Disk Image is not backed up to Time Machine, so I'm not sure what he means. The actual Disk Image (that is backed up to TM) is always encrypted.

Yes, sorry, what I wrote was misleading: 😟

When an encrypted volume (an actual disk partition or a disk image) is backed-up, the data is decrypted. It's only re-encrypted if the destination is encrypted. So if you use FileVault2, your backups of normal items will not be encrypted if they go to an unencrypted disk. But, they will be encrypted if they go to an encrypted disk or disk image.

The contents of a disk image are backed-up only when it's not mounted. If it's mounted, the disk image will appear in the backup, but the contents will not have changed.

I think you're speaking about using Disk Utility to create an encrypted Volume:

...but the OP is asking about encrypted disk images

guy toronto wrote:

Thanks for the explanation. Forgive me for being technologically dense. Are you saying that in the case of an encrypted disk image, my back-up (using Time Machine) will be encrypted?

Yes.

- when the disk is mounted (ie data unencrypted), it will not be backed up. Back-up of data will only occur when the disk is not mounted (ie when the data is encrypted). Hence backed up data is always encrypted.

Am I getting this right?

Yes.