Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What options are available for OSX full disk encryption? Which of them is the best?

share|improve this question
add comment

5 Answers

Your first option is FileVault which is not full disk encryption, but individually encrypts the home directories of each user:

In Mac OS X v10.4 (Tiger), FileVault stores the encrypted file system as a Sparse Disk Image, which is basically a single large file. In Mac OS X v10.5 (Leopard), FileVault stores the encrypted file system as a new image called a Sparse bundle. 1. Sparse bundles break images into smaller 8MB files called bands, allowing them to be backed up using Leopard's Time Machine feature

-- Wikipedia on FileVault

This is in addition to Disk Utility on OS X which allows you to create disk images that are encrypted individually in the same way as described above.

As was mentioned by Dave Cheney, PGP Whole Disk Encryption for OS X goes further than FileVault to actually encrypt the entire disk transparently to the OS. I use this on both my iMac (early 2008) and MacBook Air (late 2008) with OS X 10.5.x.

Encryption takes several hours, depending on the size of your disk. You can continue to use the system whilst first encryption is in progress and can restart/sleep the computer as well.

Once completed, a prompt appears before the OS X bootloader which asks for your passphrase. PGP requires you to set up a public/private key pair with which the encryption is locked to. You can add multiple keys for different users and this means that you can easily add/revoke users when necessary.

I have been using the product for almost a year now and have had no problems. OS updates run without issue and it is easy to remove the product if necessary.

Timemachine backups continue to work with the fully encrypted disk because it is transparent to the OS - the files are all accessible whilst the system is on. This means you need to encrypt your backup device(s) separately since the files will be transferred unencrypted.

It is important to note that PGP Disk Encryption does not work with Boot Camp.

You can also use it to encrypt your e-mail, iChat and external disks.

Another product I have tried is TrueCrypt which allows you to set up virtual disks that are individually encrypted. This does work on OS X but I have not used it to encrypt the full primary partition.

If you have the budget, I can definitely recommend the PGP product.

share|improve this answer
    
+1 for TrueCrypt -- highly recommended. –  Peter May 27 '09 at 14:04
    
TrueCrypt does not provide a service that can be described as FDE on Mac OS X. –  duffbeer703 Feb 12 '10 at 23:30
add comment

I was initially going to say, No, OS X does not support encryption of the boot drive, only you home partition via loopback mount. However some googling turned up PGP Whole Disk Encryption. I can't vouch for it as a solution as I have not tried it.

share|improve this answer
add comment

Have you tried TrueCrypt? Free open-source disk encryption software for Windows Vista/XP, Mac OS X, and Linux. I also like PGP Whole Disk Encryption like Dave.

share|improve this answer
add comment

At work, we tested PGP's full disk encryption in addition to Checkpoint's FDE and FileVault, and found PGP to be the best of the available options.

Briefly, it feels like PGP's solution doesn't treat MacOS as a second class citizen. The administration server has a web-based UI that works well with Firefox, Camino and Safari, so you can admin from your Mac and the preboot isn't a visibly obvious port of the Windows one.

PGP supports Windows and Macintosh, using the same admin server.

The full disk encryption feels faster than FileVault, and unlike FV, if you have a huge home directory, you don't need to have that much extra free space during the initial encryption, PGP encrypts the disk in place. You can even do work while the initial encryption is going on, unlike FileVault.

I've been using it for several months on my laptop and am very happy with it.

share|improve this answer
add comment

There is one other alternative called Checkpoint FDE that I've heard of success with but have not used myself.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.