Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For example this blog entry mentions that an existing partition with /Users can be encrypted, but it also says "secondary driver". Same remark has been mentioned in a few other blog posts I found via google.

So the question is: I have a single volume in my MBP, where the OS itself is installed, and it contains all the userdata too.

Can it be encrypted via diskutil without data loss?

Rebooting is not an issue, just need automate the steps involved.

share|improve this question
Okay, I've researched a bit and it seems you can only use File Vault 2 encryption for boot volumes, whereas diskutil encryption works for non-boot partitions only. – slhck Mar 19 '12 at 15:51

man diskutil says:

The volume must be resizable (the above types are) and also mounted. Conversion is done live and in-place; targeting the boot volume is supported; as much of the conversion as possible is done before an eject or reboot is necessary.

So apparently answer to my question is "yes".

I'll keep the question open though if there are other comments incoming.

share|improve this answer

So you may have a suitable answer to your question, but if you're still looking at the automation behind directly addressing your need, and if this is for a business, may I suggest (CV for short,) an anagram for 'FileVault Escrow'. It uses googleApps account auth to secure individual recovery keys behind an organization, so that appropriate access can be granted.

Alternatives to that solution, to decouple it from google's endpoint, are in use inside certain organizations who have not open-sourced their solution to date. I described using the central tool to CV in a standalone mode, which can be driven by solutions like Puppet or Casper with the end state being logging the recovery key into a secured database. Hope that isn't too far from the spirit of your question.

share|improve this answer

No, their bootloader is about DRM, not about customer-friendly features. You can still have fully truecrypt-ed windows around.

share|improve this answer
What does that have to do with the boot loader? Lion supports volume-based encryption of any HFS+ volume, only the Recovery Partition and FAT, NTFS, etc. are not encryped. And using TrueCrypt on Windows is not even in the question here, why do you mention that? – slhck Mar 19 '12 at 14:24
Because MAC EFI bootloader does not boot from encrypted partition even it is theoretically possible to boot fully encrypted windows on the same system at the same time. – ZaB Mar 19 '12 at 15:43
Do you know for a fact that it won't boot? Will the command just fail, or will the Mac not show any boot volume? – slhck Mar 19 '12 at 15:53
Sadly diskutil wil spit useless errors and get nowhere. – ZaB Mar 19 '12 at 18:51
I was able to run "diskutil cs convert disk0s2 -passphrase XXX" on the volume Lion was installed, no errors and during the boot, i was presented a prompt asking for harddisk password so basicly everything what ZaB has said so far contradicts my findings. – rasjani Mar 20 '12 at 10:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.