should i enable FileVault on my external backup HDD?

[al404]

I was reading some articles on i should secure my backup:

- if somebody stole my drive
- from ransomware
- from intrusions

I use CCC form my backups and make a DMG encrypt backup, i didn't now till today that is possible to FileVault an external USB disk

I don't have FileVault activate an i read some issue in past years about FV

I'm not sure what would be the best option

- FV + DMG
- FV
- DMG

 

[Fishrrman]

I don't think you want to do it.

A backup should be -easy- to "get at" in a moment of need.

If you make it too difficult to access your backup, you might not be able to access it at all...

 

[chabig]

I have my external disks encrypted with FileVault. As the OP said, it protects them from theft, and it doesn't make the data hard to "get at" in any meaningful way. All that's necessary is to enter the encryption key and any Mac can read the contents. The important point is to keep the encryption key somewhere secure and accessible. I keep mine in 1Password and my 1Password data is synced on Dropbox among all of my devices.

 

[al404]

I also have 1Password sync, do you know if is possible to keep disk unmount and let CCC mount the disk only when it does a backup?

 

[997440]

I also have 1Password sync, do you know if is possible to keep disk unmount and let CCC mount the disk only when it does a backup?

I haven't used it that way, but it appears the answer is, yes. Whether there's variables to consider, I don't know.

[...]
What if the backup drive is not available when a task is scheduled to run?
If your backup drive is attached to your Mac and unmounted, CCC will attempt to mount the backup volume, then proceed with the backup task if that is successful. If the volume cannot be mounted or is not attached to your Mac, CCC will, by default, report an error, then run the task immediately when the backup disk is reattached to your Mac. You can fine-tune CCC's handling of this scenario using the options at the bottom of the Scheduler panel.[...]

https://bombich.com/kb/ccc4/frequently-asked-questions-about-scheduled-tasks#tgt-missing

CCC PDF Manual : https://bombich.scdn1.secure.raxcdn.com/sites/default/files/bulk_pdf/ccc4-documentation-en.pdf

 

[FreakinEurekan]

FileVault only applies to the startup disk; what you're asking about is encryption. You could encrypt the external by erasing it (i.e. choose file system Mac OS Extended (Journaled, Encrypted). Or, you can leave the disk unencrypted but encrypt the Time Machine backup itself. https://support.apple.com/kb/PH25615 shows how to do that.

If you're carrying the disk around with you so it's vulnerable to be lost/stolen, you should absolutely do one or the other of those.

 

[chabig]

FileVault only applies to the startup disk; what you're asking about is encryption.

I'm not sure what you mean. FileVault IS encryption. External volumes can be encrypted exactly the same as internal volumes. Volumes with data can be encrypted without erasing.

 

[FreakinEurekan]

FileVault is the term used for encrypting the startup disk specifically. Encryption of other disks is not referred to as "FileVault". It's just a terminology issue, doesn't affect the answer.

FileVault: http://support.apple.com/kb/HT204837

Encrypting removable media: https://support.apple.com/kb/PH25745

Encrypting Time Machine backups: https://support.apple.com/kb/PH25615

 

[Weaselboy]

I also have 1Password sync, do you know if is possible to keep disk unmount and let CCC mount the disk only when it does a backup?

Using FV to encrypt the external disk and using an encrypted bundle (DMG) together is kind of redundant. I just encrypt the entire volume by formatting to the encrypted format.

Once you do that, eject the volume. Now mount the volume in Disk Utility... you will get a popup asking you to enter the password. In that popup is a checkbox asking if you want to remember the password in Keychain. Check that box. From then on, when you attach the drive it will pull the password from Keychain and automatically mount.

I use this setup for CCC clones to an encrypted external disk and it is very easy.

 

[al404]

thanks, i did encrypt my disk with right click in finder, is not necessary to erase contents