0

Can I boot from an external drive with hardware encryption?

For example I can add a password to my Samsung T5 that turns on the drive’s hardware encryption. Can I boot from that, as long as I know the password? (I assume yes, but that I’ve got to install Samsung software on the target machine first.)

Is the answer any different if I additionally enable FileVault on the external drive (APFS, GUID)?

orome
  • 11,983
  • 64
  • 144
  • 260

1 Answers1

1

I don't think so, because the drive can't be unencrypted by the Mac before an OS is loaded.

If you want to encrypt your data, then using FileVault is the best way, and your Mac knows how to boot from a FileVault drive.

However, it will boot to Recovery first, then ask you for the drive's password, then let you boot up.

benwiggy
  • 35,635
  • That makes sense. I'd have to turn off the hardware encryption before. FV has one serious shortcoming: the password must match the password of the account that's active then FV is enabled. – orome Dec 09 '19 at 18:43
  • @orome No: technically the password for the disk can be different from your user password. However, the user account can automatically supply the password to the disk at boot. When you create an encrypted disk with Disk Utility, you can set the password. – benwiggy Dec 10 '19 at 07:34
  • No, FV uses the password of the account that’s active when FV is enabled. – orome Dec 10 '19 at 13:46
  • @orome Technically, the password for FV and the user password are two different entities and can be different. Note that Disk Utility has a menu item to Change the Password of encrypted disks (outside of the current system.) See this question which is about making them the same when they are different: https://apple.stackexchange.com/questions/159961/change-osx-encryption-filevault-password-to-match-login-pass – benwiggy Dec 10 '19 at 13:54
  • That item is disabled. It doesn't apply to FV does it. It applies to disks formatted as "encrypted", I think. The question you link confirms that: it describes a process for ensuring that involves taking advantage of the fact that FV (only) uses the password of the account that’s active when FV is enabled, and that FV and user account passwords are synchronized when the user password is changed. – orome Dec 10 '19 at 15:26
  • FileVault and Disks formatted as encrypted are the same thing. – benwiggy Dec 10 '19 at 16:25
  • How does one encrypt a FV drive with a password that is different from the one used by the active user account? – orome Dec 10 '19 at 16:58
  • By formatting the drive as encrypted in Recovery Partition. https://blog.filippo.io/filevault-2-custom-passphrase/ – benwiggy Dec 10 '19 at 17:08