filevault 2 slow sierra

Question

Level 1

9 points

filevault 2 slow sierra

I work in IT at a small college, and we regularly encrypt faculty, staff, and loaner computers using FileVault 2. The process usually takes about 8 hours with a hard disk drive, depending on size it can be a little more or a little less. Our standard practice is to leave it running overnight. With macOS Sierra we are seeing it take about 3 days if left unattended.

After some investigation it turns out that the disk speed is throttled every 5 minutes, going from about 30-35 MB/sec to 3-5 MB/sec if the computer is not in use. It stays at the low rate until the user takes some action, like a mouseclick, and it then recovers for another 5 minutes. It appears that the culprit is DuetHeuristic-BM, which is responsible for running periodic tasks like checking whether it's time to do a Time Machine update (Time Machine is not configured on these machines, but just for the sake of example).

This is 100% reproducible across multiple computers with traditional HDD's, and persists at least through 10.12.4. Occurs on clean OS installs as well as computers loaded with our images. Have not tested on SSD's. The common factor is macOS Sierra, which I believe introduced DuetHeuristic-BM.

The net result is that the computer will encrypt much faster if it is being used during the encryption process. That's practical in some cases for us, not in others.

macOS Sierra (10.12), FIleVault 2

Posted on Mar 31, 2017 6:05 AM

Reply

Answer 1

cdhw

Level 4

3,588 points

Apr 12, 2017 11:30 AM in response to kmmacg

You might try the terminal command caffeinate(8), which would be a little quicker than installing a Jiggler.

This briefing document contains much useful information:

http://training.apple.com/pdf/WP_FileVault2.pdf

You could also review your risk/threat analysis. Are you sure you can't give most users a machine that is still encrypting? My understanding, although I can't cite an authoritative source off the top of my head so I might be wrong, is that there'll be nothing confidential that is unencrypted because any new files added by the user will be encrypted at the time they are copied to disk so no user data is ever vulnerable.

C.

Reply

Answer 2

John Galt

Level 10

146,486 points

Apr 12, 2017 11:42 AM in response to cdhw

... there'll be nothing confidential that is unencrypted because any new files added by the user will be encrypted at the time they are copied to disk so no user data is ever vulnerable.

This is correct. Excerpted from Use FileVault to encrypt the startup disk on your Mac - Apple Support:

Any new files that you create are automatically encrypted as they're saved to your startup disk.

Reply

Answer 3

John Galt

Level 10

146,486 points

Apr 12, 2017 7:53 AM in response to kmmacg

The net result is that the computer will encrypt much faster if it is being used during the encryption process.

That is correct.

There is little practical justification to decreasing the amount of time it takes for FV to finish encryption. Any new data added to the device will be encrypted as it is added. If a FV disk is new, obviously there won't be anything to encrypt. It still takes time though.

Solid state memory will obviously encrypt much faster. Apple's apparent interest in rotating media has waned ever since they implemented flash memory in all new devices.

Reply

Answer 4

Apr 12, 2017 7:56 AM in response to John Galt

I am not sure you are understanding the issue. We image Mac's all day and encrypt them all day. Something changed in 10.12.4 to cause it to be slow if the machine sits idle. We literally have to just move the mouse to get encryption to complete in a "normal time". Otherwise it takes almost days to encrypt flash memory OR platter HD's.

Reply

Answer 5

kmmacg Author

Level 1

9 points

Apr 12, 2017 8:01 AM in response to John Galt

Ditto what Brewcaster said. Also note that when encrypting a boot drive with FileVault 2 that it appears it encrypts the entire disk, not just the populated portion. My experience is that encryption time is dependent on disk size & disk speed.

Reply

Answer 6

Apr 12, 2017 11:36 AM in response to cdhw

Thanks, we will look into the caffeinate commands.

On the risk/threat end of things. We require any organizational data to be required to be encrypted. Including the base image and software included within.

Reply

Answer 7

Apr 12, 2017 11:46 AM in response to John Galt

Fair enough. We are in opinions now. Same Mac: leave it to encrypt untouched =takes 2 days, wiggle the mouse every few minutes = takes about 30 minutes.

It used to always take 30 minutes. If you are not concerned with this, that's OK. Others are.

Reply

Answer 8

John Galt

Level 10

146,486 points

Apr 12, 2017 11:59 AM in response to kmmacg

Also note that when encrypting a boot drive with FileVault 2 that it appears it encrypts the entire disk, not just the populated portion. My experience is that encryption time is dependent on disk size & disk speed.

That is also correct.

Reply

Answer 9

kmmacg Author

Level 1

9 points

Apr 12, 2017 12:04 PM in response to cdhw

Thanks for the caffeinate tip, I'll check it out.

We can deploy many of our computers while still encrypting, but we have computers that may contain sensitive information that will sit on a shelf for a period of time.

Reply

Answer 10

Apr 7, 2017 9:08 AM in response to kmmacg

We are having this exact same experience. We are seeing it on SSD's as well.

Reply

Answer 11

kmmacg Author

Level 1

9 points

Apr 12, 2017 5:29 AM in response to kmmacg

We found a workaround for now--a little freeware app called "Jiggler" that simulates mouse input, so that the encryption will keep going.

Reply

Answer 12

Apr 12, 2017 7:43 AM in response to kmmacg

I suppose you gotta do what you gotta do. But a program like that defeats our screen saver and workstation lockout policy, so we may just wait for Apple to address.

Reply