It seems standard to use Disk Utility to create an encrypted disk image. I would like to know how secure this is. I can imagine that the "encrypted" files are not really encrypted at all, and continue to lie on the hard disk in plain, unencrypted form. Are the individual files or file chunks themselves encrypted?

If one is lucky, one can recover deleted files from a hard disk. It might, as far as I know, be just as easy or maybe easier to recover files on an encrypted dmg.

My question is: what are the facts here? And how secure are the files in an encrypted disk images?

  • 2
    What exactly is your question here: "How does DMG encryption work", "how can I encrypt critical data" or something else? Can you please clarify your question to be more specific, you can always create a second question later on. – nohillside Nov 12 '13 at 22:10
  • 2
    I occasionally need to send email attachments containing complex passwords in readable form, as well as confidential documents. Wrapping these up in a 256-bit AES encrypted .dmg is pretty darn secure. In 2003, the US Government stated that "...the AES algorithm (i.e., 128, 192 and 256) are sufficient to protect classified information up to the SECRET level." The original files, before they're encrypted, lie out in plain sight unless you secure delete them in the Finder. Why you imagine that the .dmg isn't really encrypted after all is a question only the NSA can answer. – IconDaemon Nov 13 '13 at 0:39
  • @IconDaemon feel free to answer this and flag for outdated comments to get purged... – bmike Nov 13 '13 at 1:22
  • @IconDaemon: Every day I need a password to access the contents of a certain disk. The files to which I then have access are and always were in plain text. Thanks for your reassurance that my past experience is not a reliable guide to this new situation. – David Epstein Nov 13 '13 at 22:56

The files on an encrypted disk image are encrypted.

As you can see currently you can have 128 bit AES and 256 bit AES. As is pointed out 256 bit will be slower but more secure, however both methods will leave your data encrypted, until it is decrypted.

enter image description here

The real issue is how strong the password for the encrypted volume is. If the password is not a random string of characters, but based on a dictionary word with substitutions of 1 for i etc, the files while encrypted might as well not be.

enter image description here

Ensure your password is based on a long sentence where you use all punctuation marks, include spaces, numbers and special characters.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .