Is it safe to APFS encrypt a portable SSD drive?

[aryeh]

I’m a longtime Motu user (Pro Composer ’86, Performer ’87...) whose been reading the MotuNation forums for many years. I believe this is my first post.

Is it safe to APFS encrypt a portable SSD drive? I’m in the habit of carrying around a backup portable drive on my person; however, in the back of my mind, there is always the concern of losing the drive, etc. Apple claims that APFS encrypt is extremely reliable and unlikely to become corrupted so I am tempted format the drive with this option. As I also keep personal info (.e.g. banking, tax history, legal documents...) on this drive, I’ve considered just encrypting a folder for these PDFs, JPEGs etc. and not encrypting the folder where my DP files reside (corruption of DP projects is the concern). But it would be much more secure to just put a password on the entire drive from all I have researched. Any thoughts, etc.?

One last question: does encryption just put a password on the drive (or folder) or does it actually mess with the contents of the folders. Thanks.

DP 9.52 (purchased but yet to install 10.01); OS 10.14.6: MacBook Pro (Retina, 13-inch, Early 2015), 8GB RAM, 128 GB; Samsung T3 500GB, T5 500GB, T5 1TB; ULN-2 (legacy); PianoTeq 6; Finale 26.1

[monkey man]

Welcome, mate, and congrats on finally posting after all these years!

APFS is not an encryption in the sense you're thinking of it; it's a file system, just as FAT32 is on Windows or HFS / HFS+ is on Mac. IOW, you format a drive as APFS and then use it as you would any other formatted drive.

You can copy files to and from drives formatted with the older system/s you've used; the only difference you might notice is that they tend to use a little less space under APFS (use the Get Info window to confirm this).

Copying a file back to an older system, you'll see it "reverts" to the larger size; it's just an efficiency thing with the new format.

[aryeh]

Thanks so much for the warm welcome from Down Under! I’m a longtime composer/songwriter, originally from Canada, now living in New York.

Regarding my post: When erasing a drive—to format it—the second option on the pulldown menu is “APFS (Encrypted)”. Evidently, this will require a password every time the drive is plugged into a computer. I just figured that folks on this board must have some insight whether it’s a safe or not for the DP data and how/if the files would be affected by the drive encryption. My MacBook Pro’s internal drive is APFS by default. Cheers!

Aryeh

DP 9.52 (purchased but yet to install 10.01); OS 10.14.6: MacBook Pro (Retina, 13-inch, Early 2015), 8GB RAM, 128 GB; Samsung T3 500GB, T5 500GB, T5 1TB; ULN-2 (legacy); PianoTeq 6; Finale 26.1; keyboards; guitar

[monkey man]

Ahh.. I've never chosen the "encrypted" or "case-sensitive" options when installing OS's; always gone for the plain-vanilla (default) choice, Aryeh.

Wanna know why? I'm too-ignorant to know what the choices mean and don't want to risk confusion and possible "gotchas" down the road.

[aryeh]

re: APFS (encrypted) Yes, this would be a first for me too; never put a password on an encrypted drive before. But if it is safe, a very good idea for a portable SSD. Maybe someone out there has some insight on the matter?

DP 9.52 (purchased but yet to install 10.01); OS 10.14.6: MacBook Pro (Retina, 13-inch, Early 2015), 8GB RAM, 128 GB; Samsung T3 500GB, T5 500GB, T5 1TB; ULN-2 (legacy); PianoTeq 6; Finale 26.1; keyboards; guitar

[monkey man]

Indeed, mate; the heavy hitters will arrive shortly...

[mikehalloran]

Not enough information. The correct answer: It depends.

If the only Macs that will be connected are formatted APFS, then yes, go ahead. Otherwise, don’t.

A non-APFS drive like, say, a Mac booted into Sierra, cannot see an APFS drive. The reverse is fine.

As to encryption, again, it depends. You can encrypt folders or the entire drive, You can also hide folders though that is easily defeated. Apple has support docs on the subject. Time to catch up on your reading.

No matter how you have it set up, you must do the following if this drive is to be accessed by more than one Mac: run Get Info and scroll down. Make sure that Ignore ownership... is checked. Otherwise, you will have problems writing to it from a Mac other than the one that created the drive.

[aryeh]

Thanks for chiming in, Mike. I feel like I know you too as I’ve been reading your helpful posts for years.

“If the only Macs that will be connected are formatted APFS, then yes, go ahead. Otherwise, don’t.”

Yes, APFS to APFS only. When you said, “go ahead,” did you mean regarding encryption? If so, I guess you’re pretty confident that the encryption won’t mess up DP files, etc.

“As to encryption, again, it depends. You can encrypt folders or the entire drive, You can also hide folders though that is easily defeated. Apple has support docs on the subject. Time to catch up on your reading.”

My thinking is to encrypt the entire drive. I’ve spent hours on the web looking for answers to some of my questions (and feedback from DAW users who have tried encryption) but haven’t found much of anything including an answer to the following question:

“does encryption just put a password on the drive (or folder) or does it actually mess with the contents of the folders.”

i.e. are the files themselves scrambled up in some way? And if so, is it of concern?

My record/backup workflow: I dedicate one external SSD drive for recording and another external SSD to store the DP projects. The drive with the stored projects functions as the MASTER from which further backups are made onto other drives (e.g. Lacie, Seagate). It’d be a nightmare to one day find that the master has become corrupted because of encryption and subsequent copies corrupted, etc. FWIW, from what I have gathered, this is unlikely. Do you agree? Hope I haven’t left anything important out. Thanks again.

DP 10.01 (9.52)
MacBook Pro (Retina, 13-inch, Early 2015), 8GB RAM, 128 GB; OSX 10.14.6
ULN-2; SSD Samsung T3 500GB, T5 500GB, T5 1TB
PianoTeq 6; Finale 26.1; Logic Pro X; Alesis QS7 synth; guitars

[mikehalloran]

APFS is formatting. Encryption is encryption though it is a little different when APFS is involved.

Is this going to be a boot drive? Is it going to store DP projects? What kind of Mac do you have and what is this external?

[aryeh]

Is this going to be a boot drive?
No.

Is it going to store DP projects?
Yes.

What kind of Mac do you have...
MacBook Pro (Retina, 13-inch, Early 2015), 8GB RAM, 128 GB SSD; OSX 10.14.6

...and what is this external?
Samsung T3 SSD, Samsung T5SSD

from earlier in the thread:
I just figured that folks on this board must have some insight on WHETHER IT IS SAFE OR NOT FOR THE DP DATA (i.e. when encrypting a drive) and how/if the files are affected by drive encryption. My MacBook Pro’s internal drive is APFS by default. (My MacbookPro is not nor will be encrypted.)

My record/backup workflow: I dedicate one EXTERNAL SSD for recording (which will not be encrypted) and another EXTERNAL SSD to store the DP projects (which I would like to encrypt). The drive with the stored projects functions as the MASTER from which further backups are made onto other drives (e.g. Lacie, Seagate). It’d be a nightmare to one day find that the master has become corrupted because of encryption and subsequent copies corrupted, etc.

[mikehalloran]

For many reasons, I do not recommend recording onto one external and storing active projects onto a second. Recording and active projects should be on the system drive. Speed and data security are the the main reasons but there are others.

Externals are for archiving and backup. Your external drive is about half the speed of the internal SSD on your MBP.

You have the same MBP that my daughter has with the same sloooow, low capacity AHCI blade. Unlike the 2013–14, there is no downside to upgrading a 2015.

You can install a 2.5x faster NVME 3 x4 blade (Intel 660p) for around $250 (2TB) including tools and adapter or a nearly 4x faster blade (970 EVO) for about double. Obviously, a 1TB will cost less.

This is very easy especially as you have a T5 to use as an install disk. It will take a couple of hours or less including data transfer and is a simple DIY.

Tools will be a P5 pentalobe driver and a Philips driver for the adapter if you get the long one (not recommended). You will also need a T6 plus a T5 for the $9 keyboard cable that you will be also replacing (this cable is well known to fail after the back has been removed even though you don't touch it during the course of the upgrade). wondering where I was going to find that cable on a Sunday when my kid needed to get back to school was no fun—fortunately, Amazon was able to get it same day.

[HCMarkus]

For many reasons, I do not recommend recording onto one external and storing active projects onto a second. Recording and active projects should be on the system drive. Speed and data security are the the main reasons but there are others.

viewtopic.php?f=4&t=66564&p=565663#p565663

Your apps and working files should be on the boot drive. Period. That means that DP and current project(s) plus system files, plugins etc. all need to be on your system drive which should never be partitioned with another bootable OS. Since High Sierra and APFS, there is no argument or debate to engage on this issue although I’m happy to explain why.

MIke, you have repeatedly stated as such over the last couple of years, but have not responded when I requested an explanation in at least two prior threads; the quote above is from the last one I recall in July of this year. Maybe you missed my queries.

You mention "speed" as a reason to avoid recording to a separate drive. How is it possible speed is an issue when recording to TB PCIe or SATA SSDs? For years we successfully recorded large projects onto spinning HDs. Now we have SSDs, which smoke those old spinners. Projects open from internal or external SSD drives very quickly and speed is certainly more than adequate when comes to audio playback and recording.

Data security? Other reasons?

Like many others, I have been recording to projects stored on a drive other than my boot/system drive for years. Never have I had an issue. I've searched the web, but have not found a single source to confirm your statements in this regard.

I want to understand the basis for your recommendation, and I'd be extremely surprised if I'm the only one interested. Please illuminate us!

[aryeh]

FWIW, as the thread has totally moved away from my question: from 2004-08 my workhorse was a 2004 single processor 15” MacBook Pro recording (24/44.1) to an external Glyph firewire 400 drive via a ULN-2. Some of those projects have 30 audio tracks running at the same time (something I certainly could not do back in the 70s with a Studer or MCI) with reverb across the board. In short, my system never had a hiccup. My current 13” dual processor smokes that machine in every way but screen size which is easily remedied with the addition of a second larger monitor. As I’m not running large sample libraries or CPU hog software synths, I don't need a faster machine with more ram at this time. Regarding my humble 128GB internal SSD, I only use it to instal applications. I have always viewed my current 13" MacBook Pro as a transition to my next larger screen model.

BUT TO STAY ON TRACK: If anyone has a an answer to the question I posed in the subject of this thread, I’d very much appreciate it: Is the Digital Performer data safe (i.e. when encrypting an SSD drive as APFS encrypted) and how/if the files are affected by the encryption. Thanks.

[HCMarkus]

Sorry to have dragged this thread off-track aryeh.

From your detailed writings, it doesn't sound like a quick Google search is gonna' provide the assurance your seek re: encrypted APFS project drive. I did note that Apple advises us one can format an APFS drive with multiple volumes, each with its own format:

Apple File System (APFS)
You can easily add a volume to an APFS container. Each volume within an APFS container can have its own APFS format—APFS, APFS (Encrypted), APFS (Case-sensitive), or APFS (Case-sensitive, Encrypted).

I'm thinking that the quickest way to get a solid answer here may be to create two volumes, one each APFS and APFS (Encrypted) format, on your SSD. Write a several duplicate test DP Projects to each, then experiment. Do backups and test their integrity before committing to a format type.

My quick search does suggest that APFS (Encrypted) formatting may reduce drive performance. One individual I ran across thought he saw a 40% reduction (seems suspect); another about 15%. Whether this is a concern for you (given the tremendous speed SSDs provide) is only you will be able to answer if you note performance degradation in your testing.

It does sound like you are more concerned about security for your banking and personal information than for DP. Perhaps using the multiple volume approach would allow you to have the best of both worlds... security for your personal info and no worries for DP data.

I will insert my standard backup plea here... If you have but one copy of your data, you don't really have your data. Two is better than one, but I sleep best when I have at least three copies, including at least one off-line, at all times.

Best wishes!

[aryeh]

@ HCMarkus Glad to have your input. Threads have a tendency to get off track (not always a bad thing) and this thread had already wandered before you chimed in.

The reason I’m thinking it best to encrypt the entire drive is simply to put a lock on the whole enchilada. This is because from what I gathered perusing the web, if a drive can be accessed, it’s much easier to decrypt individual volumes on it. Who knows?

Regarding speed, yes, I read it can slow things down a “bit” but as I am not working from this drive, I wouldn’t expect it to be a big deal.

As there does not seem to be a clear answer regarding regarding the question of “Is the Digital Performer data safe (i.e. when encrypting an SSD drive as APFS encrypted) and how/if the files are affected by the encryption,” I’m thinking to dedicate one portable SSD for experimentation. i.e. only write to this disk and test it occasionally by dragging a file to an unencrypted SSD. This experiment could go on for a looooong time.

Regarding backups, by now you should know who you’re talking to, LOL. I have multiple backup drives at various locations. Barring a solar flare... Shudder!

Thanks!