FileVault-How much hard drive space is enough?

[iThinks]

Hi! Thanks for helping me.

Trying to turn on FileVault I get a message saying:

There isn't enough space on your hard disk to turn on FileVault.
Turning on FileVault requires an additional 132.2 GB of free space on the volume "Macintosh HD". Try emptying the Trash or deleting files you don't need.

Finder says that hard drive "Macintosh HD" has a capacity of 499.76 GB and that 180.42 GB are available.

Am I to understand that to run FileVault I would need 312.62 GB (132.2 + 180.42 GB) empty on a 499.76 GB hard drive?! Seems crazy!

Might this be related to Parallels 6 or something?

Recommendations?

Thanks!

 

[Mal]

Turning on/off FileVault requires the amount of space that your user folder takes up to be available (plus a small amount extra, IIRC). That means if your user folder is approximately 300GB (guessing it is, from your post), it needs that plus just a little extra to enable/disable FileVault, because it has to copy it all into the sparsebundle that FileVault uses, before it can delete the originals, in order to avoid the risk of losing data if the process is interrupted.

Might I ask, btw, why you're considering turning on FileVault? It generally has a high risk of issues and is overkill for most needs.

jW

 

[angelwatt]

It generally has a high risk of issues and is overkill for most needs.

Pre-Leopard had some issues because it was a single file (sparse image), but the since Leopard, it uses a sparse bundle, which are many separate files. This makes it much more stable and resistant to corruption. I've been using FireVault since Tiger with all of my Macs and never had an issue.

I do agree on the second part of your statement though. It's overkill for most people. Using encrypted disk images is often a good idea so only sensitive files get encrypted. I'm also a fan of TrueCrypt when larger amounts are needed to be encrypted or you need cross-platform compatibility.

 

[iThinks]

FileVault size, Why, Parallels/Outlook 2010 on Win7x64

Thanks! First another question, then a reply to your question:

So would I forever/always be required to have 2X (plus a little) of free space on my hard drive, or is that just for the initial run? (If it's just initially I could slide some junk to an external disk temporarily, right?)

Now for your question:

Might I ask, btw, why you're considering turning on FileVault? It generally has a high risk of issues and is overkill for most needs.
jW

My company obligates disk encryption and I'd have to agree that they should. On PCs (before my recent switch) in recent years I used PGP Whole Disk encryption (which was also helpful w/ encrypted email). Although that solution exists for Mac now, too, I've been sad to learn that it doesn't automatically encrypt/decrypt my Outlook 2010 emails (run on Parallels 6 w/ Win7 x 64). So, I figured as long as I need to re-evaluate options I should consider a built-in solution: FileVault. From what I read it's encryption is strong and it works with another built-in solution for backup (TimeMachine).

Thoughts?

 

[iThinks]

FileVault stability

Pre-Leopard had some issues because it was a single file (sparse image), but the since Leopard, it uses a sparse bundle, which are many separate files. This makes it much more stable and resistant to corruption. I've been using FireVault since Tiger with all of my Macs and never had an issue.

Thanks for the user testimonial. That's reassuring to hear!

 

[Mal]

Thanks! First another question, then a reply to your question:

So would I forever/always be required to have 2X (plus a little) of free space on my hard drive, or is that just for the initial run? (If it's just initially I could slide some junk to an external disk temporarily, right?)

Now for your question:


My company obligates disk encryption and I'd have to agree that they should. On PCs (before my recent switch) in recent years I used PGP Whole Disk encryption (which was also helpful w/ encrypted email). Although that solution exists for Mac now, too, I've been sad to learn that it doesn't automatically encrypt/decrypt my Outlook 2010 emails (run on Parallels 6 w/ Win7 x 64). So, I figured as long as I need to re-evaluate options I should consider a built-in solution: FileVault. From what I read it's encryption is strong and it works with another built-in solution for backup (TimeMachine).

Thoughts?

Sounds like you've eliminated the possibility of it being overkill, but I still don't know if it's the best solution for you. PGP is a good solution usually, but of course if you're running a virtual machine, it's going to encrypt/decrypt the entire disk image for that virtual machine, and not components within it. I wonder, though, if it's not possible to run a second encryption software within the virtual machine to avoid that issue?

Just a note on the space issue, you don't always need to keep that extra space, you only need it when you enable FileVault, and if you ever want to disable FileVault. All of the stuff it does while operational will only require a small amount of extra space, 30-40 GB's at most probably.

jW

 

[g-boac]

Pre-Leopard had some issues because it was a single file (sparse image), but the since Leopard, it uses a sparse bundle, which are many separate files. This makes it much more stable and resistant to corruption. I've been using FireVault since Tiger with all of my Macs and never had an issue.

Hi angelwatt,

Quick question - I am in a similar boat as the original poster where I need to use FileVault to encrypt my work computer. I just set up a home MacBook Pro, and wondering whether to use FileVault. My principal concern was corruption/dataloss. I do back up using Time Machine, but was wondering whether sparse bundles are any more sensitive to data loss or corruption than data files alone are. Sounds like you may know a bit about FileVault and are comfortable with it?

Also, I know that I won't be able to "live browse" Time Machine backups using the user interface. Any other operational overhead/downside?

I guess I'm weighing all this against the possibility of a (likely remote) chance of laptop loss/theft. My sensitive files (passwords, accounts) are in an encrypted disk image anyway.

thanks!
Mark

 

[angelwatt]

Quick question - I am in a similar boat as the original poster where I need to use FileVault to encrypt my work computer. I just set up a home MacBook Pro, and wondering whether to use FileVault. My principal concern was corruption/dataloss. I do back up using Time Machine, but was wondering whether sparse bundles are any more sensitive to data loss or corruption than data files alone are. Sounds like you may know a bit about FileVault and are comfortable with it?

Also, I know that I won't be able to "live browse" Time Machine backups using the user interface. Any other operational overhead/downside?

I guess I'm weighing all this against the possibility of a (likely remote) chance of laptop loss/theft. My sensitive files (passwords, accounts) are in an encrypted disk image anyway.

I'll give my best idea. For general usage, I don't feel FileVault has anymore chance of data corruption than having it off (since Leopard). This is mostly because the drive is formatted as Journaled. As Wikipedia states about Journaled:
[QUOTEwikipedia]A journaling file system is a file system that keeps track of the changes it intends to make in a journal (usually a circular log in a dedicated area of the file system) before committing them to the main file system. In the event of a system crash or power failure, such file systems are quicker to bring back online and less likely to become corrupted.[/QUOTE]
I don't use Time Machine with FileVault because, as I remember, it only does the backups when you log out. I only reboot about once a month so that doesn't work well for me. I use the command line program rsync. I use to use Carbon Copy Cloner, but they dropped support for some file system formats. rsync isn't for the lighthearted though since it does involve the command line. I backup to an encrypted disk volume created with TrueCrypt so the backups are safe.

I did find this thread on creating an encrypted Time Machine backup that you may want to look into. It's not something I've tried though.

Some thing to know about FileVault. You'll need free space on your drive of at least the same amount as your home drive, because it has to copy things over. The same is true when turning off FileVault. There is a slight performance hit when FileVault is on. Read speed is essentially the same, but write speed is a touch slower (since it has to expand the encryption size), though most can't notice unless working on serious stuff that's writing a lot of data, such is video editors.

 

[g-boac]

I did find this thread on creating an encrypted Time Machine backup that you may want to look into. It's not something I've tried though.

angelwatt,

Thanks for your thorough response. Copy all.

quick question on the thread you forwarded to me. . .this essentially is for having an unencrypted home directory on your computer, but backing it up to an encrypted sparse bundle on your Time Capsule, correct? [so by extension, you are only protecting data on a stolen Time Capsule, not a stolen MacBook, correct?]

thanks!!
Mark

 

[angelwatt]

quick question on the thread you forwarded to me. . .if you create an encrypted time machine backup, does this mean that you can actually back up your FileVault encrypted computer "live", as in using the user interface as though you had a plain-vanilla unencrypted account?

My understanding of why Time Machine must wait until you log out to back up is because it stores the sparse bundle (or its changes) on the Time Capsule, but it can't do that until you've logged out and unmounted your sparse bundle first. Am I understanding this correctly?

From the way I read the instructions it sounds like it does live backups, but as I said before, I haven't tried this method so can't vouch for it. On your second part I can't say for certain, but the sparse bundle is stored locally, not on the backup location (well until it does the backup). It scans for differences when it goes to do the backup I believe. I found another article on this topic that may help too that discusses backing up FileVault while logged in, though it goes to an unencrypted volume, but that might be able to be mixed with the other thread.

. .this essentially is for having an unencrypted home directory on your computer, but backing it up to an encrypted sparse bundle on your Time Capsule, correct? [so by extension, you are only protecting data on a stolen Time Capsule, not a stolen MacBook, correct?]

The home directory is definitely encrypted because FileVault is on and it's for the home directory, so that shouldn't be an issue.

 

[Wolfpup]

Can't you just encrypt drives, and then tell Time Machine to use an encrypted drive for backups? And I THINK Time Machine's backups are accessible without using Time Machine...which is cool.

I'm super gun shy about encryption anymore. I used TrueCrypt for years under Windows XP and it worked fine, but it always ended up corrupting 64-bit Vista. Ended up corrupting my external backup drive too eventually...sooooo I'm hesitant to use things like it, although you'd hope the encryption Apple and Microsoft provide built in to their OSes would work better...hopefully.

 

[g-boac]

angelwatt - thanks! that last post helped me connect the dots on everything. Thanks for your responses. What I've taken away from all of this is that it's absolutely possible to encrypt both your hard drive and your backups, and it's possible for all to work together - but you need to do a little bit of unconventional hacking to make that happen. It seems that this is something that Apple can, and hopefully will, tie a bow around as part of their OS 10.7 release.

wolfpup - see angelwatt's response, post [6], for instructions on how to do what you asked; if not the exact process you were proposing, the end result is the same.

thanks,
Mark