Cloning a Filevault 2 boot device with Disk Utility.

Huh? Anybody alive in the vicinity?

Seriously, could anybody answer the question I asked?

Regards,

Denis MAILLARD

OK. While waiting for an answer, I did some tests. The results are comforting,

but I'd like to know whether what I found was working is actually supported or

not by OS X engineering.

My first test was to try and obtain an encrypted external and bootable clone of

the internal Filevault encrypted system disk. I used the Disk Utility that is

included in the installation kit on the USB key to obtain it. It worked and here

is how I did it:

- boot off the installation kit on the USB key.

- enter Disk Utility

- click on the intended target disk for the backup clone

- in the "erase" tag, chose as format "Mac OS extended (journalised, encrypted)"

(note: I'm not sure of the exact English wording, as my Macs are using French)

- click the "erase" button

- when prompted, define an encryption key and confirm it

- let the erasure take place

- once it is over, select the (greyed) internal encrypted system disk

- when an encrypted disk is selected, the grey "Mount" button in the tool bar

clears and its name becomes "Unlock"; click on it

- when prompted, answer with an authorised user's password or the Filevault

recovery key: the disk's name clears and it becomes available

- click the "restore" tag

- move the recently erased disk to the target field

- click the "restore" button and accept that this will erase the target disk

Once the restore is over, exit Disk utility and then OS X Utilities. When asked

to choose a boot device, choose the newly created external clone as boot device

and, when asked, give the encryption key you defined in the above steps to

unlock it.

The Mac boots happily on the external encrypted disk and works as usual. Note

that System preference will tell you that Filevault is activated and that a key

has been defined, although, in order to boot, you must give the key that you've

defined above rather than an authorised password or the encryption key defined

by the system when Filevault was activated on the internal system disk.

So it is possible to create a usable encrypted bootable external clone of the

Filevault encrypted internal system disk with Disk Utility.

Now, I went further and tried another test, namely, to restore this external

encrypted clone on the internal system disk of the OTHER Mac.

First, you must remember that, as I previously obtained an unencrypted restore

when I last moved my system from one Mac to the other, I had to reactivate

Filevault on the second Mac, which means that the two Macs both had encrypted

internal system disks, with identical authorised user's passwords, but DIFFERENT

recovery keys...

Lets call them "Mac1" (the source for the first test above), encrypted with

recovery key "KEY1" and "Mac2" (the target of the present, second, test),

encrypted with recovery key "KEY2".

Here are the steps of the second test:

- boot Mac2 off the installation kit on the USB key.

- enter Disk Utility

- click on the internal system disk

- click the "Unlock" button

- when prompted, give an authorised user's password or the KEY2 recovery key to

unlock it

- click on the external encrypted clone of the system disk of Mac1

- click the "Unlock" button

- when prompted, give its encryption key (defined during the first test)

- click the "restore" tag

- move the internal system disk of Mac2 to the target field

- click the "restore" button and accept that this will erase the target disk

Once the restore is over, exit Disk Utility and then OS X Utilities. When asked

to choose a boot device, choose the newly created internal disk as boot device,

reboot and, when asked, give an authorised user's password or the KEY2 recovery

key.

The reboot goes on fine and the system disk is shown in System Preference as

encrypted with Filevault.

This means that I can transfer a Filevault encrypted system disk from one Mac to

another through an external clone and keep the same authorised user's passwords.

But two important remarks must be made:

- 1 The resulting disk on the target system will be Filevault encrypted if and

only if the previous version of the system on that disk was already

Filevault encrypted

- 2 While the passwords of the authorised users will remain the same, the

recovery key on the target system will be the previous recovery key on this

system disk and NOT the recovery key of the disk on the source system

Therefore, with this method, I'm condemned to have TWO DIFFERENT recovery keys.

Each was generated on a Mac when Filevault was activated on it and cannot be

transferred to the other MAC (at least, not using this method).

I'm also not sure of what would happen if I were to transfer a system disk from

one Mac to another that does not have identical Filevault authorised users. I

did not test it and don't intend to.

Now the big question is: is this method of cloning and transferring Filevault

encrypted disks acknowledged and supported by OS X engineering? Or it there a

risk that a future version will break it?

Regards,

Denis MAILLARD.