Enable encryption - Quicker to enable or to erase and copy?

[Doc69]

I have an almpost full 18TB HFS+ formated hard drive that I want to enable encryption on. Is it faster to enable encryption or to erase it, enable encryption, and then copy everything over again? I'm about to go on a trip and remember that in the past it took several days to enable encryption on large drives. Enabling it on an empty drive is almost instant. And copying everything takes maybe a day and a half. And does encryption go quicker if I convert the drive to APFS? I prefer HFS+ since I can use DiskWarrior, because I've had weird stuff happen with APFS formatted external 3.5" hard drives in the past.

 

[chabig]

Whether the disk has data on it or not, it shouldn't affect the encryption time. 18TB has to be read, encrypted, and written back to disk. This is true because the encryption algorithm encrypts the full disk, including empty space.

 

[NoBoMac]

Whether the disk has data on it or not, it shouldn't affect the encryption time. 18TB has to be read, encrypted, and written back to disk.

Minor semantics nit…

True in the case of HFS.

APFS is instant on an empty drive as APFS only encrypts “on-demand”.

 

[chabig]

APFS is instant on an empty drive as APFS only encrypts “on-demand”.

Is this true for full disk encryption or just file based encryption?

 

[NoBoMac]

For full. Which makes sense: can add/remove volumes from an APFS container willy-nilly, which share space with other volumes, can have a mix of encrypted/unencrypted volumes, extra work to encrypt blocks that might never need to be encrypted.

Transcript below. Took a thumb drive and formatted as APFS unencrypted. Added an encrypted volume. Took 1.104 seconds to create an encrypted volume. Only thing that took time was the initial APFS formatting as using a slow thumb drive.

diskutil with initial APFS container, command run, diskutil of container with a newly added encrypted volume.

Spoiler: Terminal Transcript

+-- Container disk3 14B0D5A8-5DDC-4909-924C-F0CED5A8D5D2
    ====================================================
    APFS Container Reference:     disk3
    Size (Capacity Ceiling):      31809560576 B (31.8 GB)
    Capacity In Use By Volumes:   75882496 B (75.9 MB) (0.2% used)
    Capacity Not Allocated:       31733678080 B (31.7 GB) (99.8% free)
    |
    +-< Physical Store disk2s2 A26AF09D-25FC-49F8-ABB5-D1BC090382D8
    |   -----------------------------------------------------------
    |   APFS Physical Store Disk:   disk2s2
    |   Size:                       31809560576 B (31.8 GB)
    |
    +-> Volume disk3s1 8F8D6191-6F26-4AA6-A3A5-9919A0DA089F
        ---------------------------------------------------
        APFS Volume Disk (Role):   disk3s1 (No specific role)
        Name:                      foop (Case-insensitive)
        Mount Point:               /Volumes/foop
        Capacity Consumed:         757760 B (757.8 KB)
        Sealed:                    No
        FileVault:                 No

% time diskutil apfs addVolume disk3 APFS FooSecure2 -passphrase hello
Will export new encrypted APFS Volume "FooSecure2" from APFS Container Reference disk3
Started APFS operation on disk3
Preparing to add APFS Volume to APFS Container disk3
Creating APFS Volume
Created new APFS Volume disk3s2
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk3s2
Finished APFS operation on disk3
diskutil apfs addVolume disk3 APFS FooSecure2 -passphrase hello  0.02s user 0.02s system 3% cpu 1.104 total

% diskutil apfs list
+-- Container disk3 14B0D5A8-5DDC-4909-924C-F0CED5A8D5D2
    ====================================================
    APFS Container Reference:     disk3
    Size (Capacity Ceiling):      31809560576 B (31.8 GB)
    Capacity In Use By Volumes:   76648448 B (76.6 MB) (0.2% used)
    Capacity Not Allocated:       31732912128 B (31.7 GB) (99.8% free)
    |
    +-< Physical Store disk2s2 A26AF09D-25FC-49F8-ABB5-D1BC090382D8
    |   -----------------------------------------------------------
    |   APFS Physical Store Disk:   disk2s2
    |   Size:                       31809560576 B (31.8 GB)
    |
    +-> Volume disk3s1 8F8D6191-6F26-4AA6-A3A5-9919A0DA089F
    |   ---------------------------------------------------
    |   APFS Volume Disk (Role):   disk3s1 (No specific role)
    |   Name:                      foop (Case-insensitive)
    |   Mount Point:               /Volumes/foop
    |   Capacity Consumed:         757760 B (757.8 KB)
    |   Sealed:                    No
    |   FileVault:                 No
    |
    +-> Volume disk3s2 D62BF96A-1028-4526-9652-295E8C274103
        ---------------------------------------------------
        APFS Volume Disk (Role):   disk3s2 (No specific role)
        Name:                      FooSecure2 (Case-insensitive)
        Mount Point:               /Volumes/FooSecure2
        Capacity Consumed:         753664 B (753.7 KB)
        Sealed:                    No
        FileVault:                 Yes (Unlocked)
%

ADD: back to OP, agree with @chabig, it will take foreeeeever to encrypt 18TB as HFS, full or not. So leave the drive at home and do the encryption when you get back.

 

[Doc69]

Thank you for all the replies! If I try to encrypt an HFS+ formatted drive (by right-clicking on it), it actually converts to APFS. And since Apple long ago removed the option in Disk Utility to format a drive in HFS+ with encryption, does anyone know if there’s a way to do it without converting to APFS?

Also, I did a test on a 1.5TB HFS+ formatted drive with 1TB of data, and even though it only took 5 min to mount and be ‘ready’, after several hours, it’s only 18% done! I used the command ‘diskutil apfs list’ to check the progress in Terminal.

This seems to confirm my theory that it will be way faster to erase the drive with encryption and then just copy over the data again, instead of encrypting it with the data on, as copying 17TB should take less than 40 hours while encrypting it could take many days. Does this sound about right?

 

[NoBoMac]

With newer OSes (Monterey and higher? can't recall when the cut-off was), APFS is the only encryption option. Command line diskutil has dropped coreStorage commands, and as seen, if try to encrypt a volume, will convert to APFS.

It seems to boil down to two things:

If want to keep HFS, need to find an older machine and do the encryption there. 18TB will be slowly encrypted no matter what, no sense in erasing, go through a brutally long encryption process and then do a long copy of data. Can copy while the drive is encrypting, but can't see that speeding things up as still need to encrypt 18TB and disk will be constantly seeking to do encryption and the copy at same time. So, leave it be and encrypt.

Or: format as APFS and start copying, the encryption will happen as the data gets copied to the drive. Should (? Might?) be faster but no idea how much faster as depends on model of Mac (T2 or M Mac with encryption hardware) and that's a ton of data to copy (have never moved that much via a Mac).

 

[Doc69]

If want to keep HFS, need to find an older machine and do the encryption there.

I decided to go with APFS instead. I erased the drive with encryption and copied back the 17TB of data in less than 2 days. So it's done. As a comparison, a 1.5TB test drive that I converted to APFS and added encryption to without deleting the data, it looks like it will take about 3 days to encrypt! And writing data to it while it's encrypting the rest of the data, the write speed is 1/10 of normal at around 12MB/s! So erasing the drive APFS (Encrypted) and then copy the data again is way faster than enabling encryption on a drive with existing data.