We need to talk about Encrypted APFS on Sonoma

[Wando64]

It is fairy clear to me that there is a problem with Sonoma and Encrypted external APFS disks. This has also been suggested to me by someone else on another thread.

I am starting this thread to try to understand what is everyone else's experience of this and what solution have you found, if any.

My experience is as follows:
I had been using and encrypted external HDD for Time Machine for quite a while with Ventura without any problem. This disk had three encrypted volumes within the same container. The moment I upgraded to Sonoma, this disk became inaccessible (could not be unlocked) and my only option was to re-format. I've recreated this disk, but this time instead of just adding volumes, I have actually partitioned id, so that each volume is sitting in its own dedicated container. So far it seems to hold up, but it is early days.

To edge my bets I have also attached another HDD for CCC backup (this is in addition to of site CCC backups which I have also been doing). This new CCC disk also has three encrypted volumes within one single container. This disk failed within one day and once again it could no longer be unlocked. So I have just re-formatted this disk too and once again created three partitions, so that each volume sits within its own container.

Both these disks are relatively new (just a few months).

Is this a general problem with Encrypted APFS on Sonoma?
Does it affect all configurations or only multiple volumes within a container?
What is your experience?

 

[chabig]

I have six encrypted APFS external drives. All of them work reliably every day. Each has one container with one volume. I have not seen any other reports of problems running multiple volumes in a single container. That's a tentpole feature of APFS. If it was buggy I think we'd see many reports.

 

[Wando64]

I have six encrypted APFS external drives. All of them work reliably every day. Each has one container with one volume. I have not seen any other reports of problems running multiple volumes in a single container. That's a tentpole feature of APFS. If it was buggy I think we'd see many reports.

Thank you, this is reassuring.
Are they spinners? I also have another two Encrypted APFS SSDs that are working without any issue.

In any case my CCC disk just gave me the same problem again even after creating separate containers.
As this particular disk is connected via a hub with a fairly long cable, I am starting to think that this could be the issue.
I have now removed the long cable and see what happens.
Next step will be to not use the Hub, but this is more problematic as I don't have available ports.

The other (first) HDD was and still is connected directly to the Mac.
I just find it bizarre that I am getting all of these issues immediately after upgrading to Sonoma, but I am willing to accept that perhaps it is all coincidental.

 

[chabig]

Two are spinners. Four are SSD. All are connected by USB and my max cable length is 3 feet.

 

[Fishrrman]

My opinion only.

I don't believe it's a good idea to encrypt backup drives.
REASON WHY:
The reason one "reaches for" a backup drive is because of "a moment of extreme need" when there's no other way to get to a particular file. You need that file and you need it NOW.

One wants such files (backups) to be EASY to access in such situations.

If "security" is a problem, then keep the backups in a locked drawer, safe, or just "hidden" somewhere.

Again, my opinion only.
Others will disagree.
Some will disagree vehemently.

 

[August West]

I just upgraded to Sonoma 14.3 yesterday and run two external T7 Shield SSD's formatted APFS Encrypted. Both are connected USB-C through a CagDigit hub and only have a single volume but they appear to be working just the same as they were in Ventura so far.

 

[MRxROBOT]

My opinion only.

I don't believe it's a good idea to encrypt backup drives.
REASON WHY:
The reason one "reaches for" a backup drive is because of "a moment of extreme need" when there's no other way to get to a particular file. You need that file and you need it NOW.

One wants such files (backups) to be EASY to access in such situations.

If "security" is a problem, then keep the backups in a locked drawer, safe, or just "hidden" somewhere.

Again, my opinion only.
Others will disagree.
Some will disagree vehemently.

lol A locked drawer is far from secure, easy enough to break into. Now try breaking 256 bit encryption.

 

[Wando64]

My opinion only.

I don't believe it's a good idea to encrypt backup drives.
REASON WHY:
The reason one "reaches for" a backup drive is because of "a moment of extreme need" when there's no other way to get to a particular file. You need that file and you need it NOW.

One wants such files (backups) to be EASY to access in such situations.

If "security" is a problem, then keep the backups in a locked drawer, safe, or just "hidden" somewhere.

Again, my opinion only.
Others will disagree.
Some will disagree vehemently.

As a choice I would rather always go for the simplest option, that being an unencrypted drive.
However, security is an issue; a locked drawer is not secure; and it is difficult to keep a disk always connected for hourly backups when they are in a locked drawer.
For these reason I concluded that Encryption is the solution.

To make up for the risk, I keep a fairly high degree of redundancy with my backups: 1xTM, 2xCCC (1 always attached and one kept offsite updated monthly), plus all of my data is on iCloud (this is obviously not a backup as such, but useful in case everything else fails).

 

[svenmany]

It is fairy clear to me that there is a problem with Sonoma and Encrypted external APFS disks. This has also been suggested to me by someone else on another thread.

I am starting this thread to try to understand what is everyone else's experience of this and what solution have you found, if any.

My experience is as follows:
I had been using and encrypted external HDD for Time Machine for quite a while with Ventura without any problem. This disk had three encrypted volumes within the same container. The moment I upgraded to Sonoma, this disk became inaccessible (could not be unlocked) and my only option was to re-format. I've recreated this disk, but this time instead of just adding volumes, I have actually partitioned id, so that each volume is sitting in its own dedicated container. So far it seems to hold up, but it is early days.

To edge my bets I have also attached another HDD for CCC backup (this is in addition to of site CCC backups which I have also been doing). This new CCC disk also has three encrypted volumes within one single container. This disk failed within one day and once again it could no longer be unlocked. So I have just re-formatted this disk too and once again created three partitions, so that each volume sits within its own container.

Both these disks are relatively new (just a few months).

Is this a general problem with Encrypted APFS on Sonoma?
Does it affect all configurations or only multiple volumes within a container?
What is your experience?

I only have SSDs. I have three identically configured SSD's. Each has two containers: one with two volumes and one with one. All nine volumes are encrypted. They went through the update from Ventura to Sonoma. I haven't had the issue you describe; the disks always unlock successfully.

 

[Wando64]

Thanks to all the responders. You’ve convinced me that the problem must be elsewhere, so examined my setup and reduced the length of the USB cables by repositioning the disks and I’ve not had any problems since.