Resolved Double Encryption of Time Machine Disc

[Alpha Centauri]

Hi all,

I use a DAS backup scheme with my 2023 MBP. Two ext drives for cloning with Super Duper and one ext drive for Time Machine.

During initial formatting I chose APFS encrypted, for all three discs. No problems and get asked for a PW before they mount. When I linked the one disc with TM, TM also asked if I want this encrypted and I answered..yes. So does that mean that TM ext disc is now effectively encrypted twice? Once to actually mount and then for MacOS to identify itself with the MBP?

Any negative situations having my TM disc encrypted in this way?

Cheers

 

[NoBoMac]

Not double encrypted, just re-encrypted. I've run into this in the past.

What happens is that TimeMachine re-formats the drive/partition to APFS with a role of "Backup", even if already APFS. A "plain" APFS drive/partition has a role of "User" iirc ("Data"?). So instead of TM just changing the Role (no idea if laziness or a technical reason why), TM will re-format with correct Role.

 

[Alpha Centauri]

Not double encrypted, just re-encrypted. I've run into this in the past.

What happens is that TimeMachine re-formats the drive/partition to APFS with a role of "Backup", even if already APFS. A "plain" APFS drive/partition has a role of "User" iirc. So instead of TM just changing the Role (no idea if laziness or a technical reason why), TM will re-format with correct Role.

Oh that's confusing. So TM reformats to APFS (disc previously APFS encrypted) but my initial encryption for mounting the disc is retained. Well, obviously it is as it's still required with the PW I initially set.

Hopefully I've understood this "role" part correctly and none of this should matter if I ever need to reinstall onto another Mac ? Worst case scenario I mean.

 

[NoBoMac]

Your previous encryption is wiped out as that drive/volume is erased and reformatted.

Whatever password you provide in TM setup is and will be the password for the TM volume.

Do a "diskutil apfs list" from a Terminal to see the various Roles that are assigned to APFS volumes.

 

[Alpha Centauri]

Your previous encryption is wiped out as that drive/volume is erased and reformatted.

Whatever password you provide in TM setup is and will be the password for the TM volume.

Do a "diskutil apfs list" from a Terminal to see the various Roles that are assigned to APFS volumes.

Right gotcha, it wasn't abundantly obvious to me as I had used the same PW to mount, as well as for TM.

Time for one more Q? Not sure if you use Super Duper (again, disc encrypted to mount), and immediately after pressing "Copy now", I again get asked for a PW from SD for permission to make changes. Is this simply as I encrypted this disc? Tbh I cannot recall SD doing this when using it many moons ago with an older MBP. But then I cannot recall if I had encrypted back then.

 

[Alpha Centauri]

@NoBoMac thanks for solving the riddle and explaining what's happening. I'll mark this as solved and run a quick email to ShirtPocket support about that SD question.

Cheers

 

[NoBoMac]

Not a Super Duper! user, so, not sure why. Could be a couple of things that pop to mind, 1) permission to scan all folders/files on a drive and/or 2) some magic that needs to be done to a destination drive that requires root privileges to execute.

But, yeah, best to contact the developer.

 

[Alpha Centauri]

Not a Super Duper! user, so, not sure why. Could be a couple of things that pop to mind, 1) permission to scan all folders/files on a drive and/or 2) some magic that needs to be done to a destination drive that requires root privileges to execute.

But, yeah, best to contact the developer.

Just for closure on all points and for others wondering. ShirtPocket replied almost instantaneously. The Super Duper window contains a small lock that informs of a password requirement. Clicking it disables it and cloning can proceed without being asked in the future. So, it’s SD itself and user defined.

Thanks again.