Encrypted APFS clones

[jmsgwd]

OK, I tried using Smart Update on an empty pre-encrypted APFS volume - and it worked perfectly

When SuperDuper completes the backup, the target volume is preserved as "APFS (Encrypted)" - and when I boot from it the following happens:

• First I get a prompt for "Disk Password", which only accepts the high-entropy random passphrase. The macOS account passwords are not accepted here.
• Then it appears to decrypt the drive (progress bar takes quite a long time)
• Finally a regular macOS login screen appears, where I can log in with one of the macOS accounts

This is the exact behaviour I wanted - a bootable, encrypted clone that requires a distinct passphrase.

It's interesting that the prompt for the disk passphrase says "Disk Password" rather than login for user "[Update Needed]".

Looking back at my notes, when I was using HFS+ the disk passphrase prompts were very inconsistent. Sometimes it was "Disk Password", sometimes it was both "Disk Password" and "Guest User", and other times it was both "Updated Needed" and "Guest User". It seemed to be random which one appeared. I've no idea why. I wonder if it's more consistent now with APFS.

[dnanian]

Yep, it should work. That's what the Preboot volume is for (well, one of the things). The whole thing is much better managed with APFS...now if they can only improve the performance, etc...

[jmsgwd]

Hmm, after doing these APFS clones, Time Machine is now running for the first time since running SuperDuper - and it's suddenly decided it needs to re-copy everything, instead of the usual delta.

As there is nearly 900 GB on my primary drive it's taking more than a day, and is making my laptop very hot.

Is this a coincidence?

[dnanian]

If you booted from another drive, it's possible Time Machine reset its own drive selections. TM is a bit of a black box, as you know... but it wouldn't do it because you made a copy.

[jmsgwd]

OK, I did boot from another drive - the clone - in order to test it.

Now that you mention it, when I booted up from the clone I did notice Time Machine starting a backup, up so I clicked "Skip This Backup" to stop it.

I don't recall this happening before, but maybe I just didn't notice it before - or maybe I was lucky.

I wonder if Time Machine starting up on the clone caused it to do a full re-sync next time it ran on the primary drive - and if so, how to prevent it happening in future. Maybe I should just turn off Time Machine, immediately after booting up on the clone.

[dnanian]

Again, any behavior here is undocumented by Apple. It's hard to know what it might or might not do.

You can, of course, use tmutil from a before/after copy script to do things with Time Machine. You could, for example, turn it off before copying and then turn it on after. That could potentially have it be off on the backup. But, any copy failures would leave TM off, which you'd have to watch out for.

[jmsgwd]

OK, thanks for the suggestions.