1

I have two partitions, one for boot.

Now I've enabled full disk encryption, looks like the one for boot is encrypted. But what about the other one? I'm not sure if it's also encrypted.

How can I verify that?

daisy
  • 987

2 Answers2

2

You say you "enabled full disk encryption" -- what exactly do you mean by that? If you mean FileVault, it's not truly full disk encryption (as ecnepsnai said), it's full volume encryption for the startup volume, and your second partition is not encrypted. If you did something other than turning on FileVault, it'll depend on what you used.

If you used FileVault, it is possible to separately encrypt your secondary volume in Finder by right-clicking on it, and choosing "Encrypt" from the shortcut menu. This is based on the same "Mac OS Extended (Journaled, Encrypted)" volume format that FileVault uses, but rather than automatically using your login password to unlock the volume it'll need a plain password just for the volume.

You can record this volume password in your keychain so it'll be able to unlock and mount the second volume after you log in, or optionally use Keychain Access to move the volume password from your login keychain (available only after you log in) to the System keychain (accessible anytime OS X is running) so it can mount the volume even before you've logged in.

And a technical note: even with both volumes encrypted, you still don't quite have full disk encryption. There's an invisible partition named Recovery HD that holds (among other things) the booter file that asks for your account password at startup, and uses that to get access to the main volume. That must be available before the "disk" is unlocked, and therefore cannot be encrypted. There's also a (also hidden) EFI partition used for firmware updates, which also aren't encrypted.

Gordon Davisson
  • 33,702
1

In general, no. FileVault will encrypt the largest / boot partition and not the entire disk. To inspect your specific installation, open the terminal app and type:

diskutil list

Anything that's Apple_CoreStorage might be encrypted, but might not. Anything not listed as Apple_coreStorage is not encrypted. EFI is usually 300MB of unencrypted space and the Recovery HD is usually 650 MB of unencrypted space. By default - all the user data you care about is encrypted and on a 250 GB drive - you have 0.3% of the storage not encrypted and 99.7% encrypted.

As to the might / might not part - use this command:

diskutil cs list

Look for High Level Queries in the middle of that output (and you might have to scroll back to see that output in a small terminal window). You want to see "Fully Secure" and a conversion status of Complete.

bmike
  • 235,889
  • You said, "EFI is usually 300MB", did you mean 200 MB? I ask because all of my EFI partitions are ~200 MB, (209.7 MB to be exact). – user3439894 Dec 12 '16 at 14:56
  • @user3439894 I rounded the results - most of my machines are now 314.6 MB for EFI but I know it used to be smaller as you report. – bmike Dec 12 '16 at 15:08