I wrote before about my odd set up for backups. I bought a new computer recently and wanted to create those odd backups again and I discovered that setting up encrypted sparse bundles was harder than I remembered! So I documented it this time for other people.
First, use Disk Utility to create an encrypted sparse bundle disk image and then mount it. It doesn’t matter what you call it. Just make sure that it is a sparse bundle image and not anything else. You also want to make sure that it is of a sufficient size to hold all of your backups. If your laptop disk is 1TB maybe make the sparse bundle 2TB or 4TB or something.
Next, you’ll want to tell your computer to use it for backups:
sudo tmutil setdestination /Volumes/mysparsebundle
After the backup starts, just stop it. You’ll see a new sparse bundle inside the first sparse bundle. That new sparse bundle is the one with your backups in it. First you’ll want to encrypt the sparse bundle:
hdiutil convert /Volumes/mysparsebundle/laptopname.backupbundle -format UDSB -encryption -o /Volumes/mysparsebundle/laptopname.sparsebundle
You can verify that you’ve encrypted it by running either of these commands:
hdiutil imageinfo laptopname.sparsebundle | grep Encrypted hdiutil isencrypted laptopname.sparsebundle
Now that it is encrypted and you’ve verified that it is encrypted you can copy the encrypted sparse bundle off of the original sparse bundle and directly to the external drive:
mv /Volumes/mysparsebundle/laptopname.sparsebundle /Volumes/externaldrive/
You can now unmount and remove the old sparse bundle since you’ve copied the actual backup drive out of it.
Finally, you will need to mount
laptopname.sparsebundle and tell your computer to back up to that file instead, like this:
sudo tmutil setdestination /Volumes/Time\ Machine\ Backups
And now you’re backing up to an encrypted sparse bundle. Since you interrupted the initial backup earlier you will want to start it for real now and let it finish. Note, though, that it will tell you that you are backing up an encrypted disk to an unencrypted disk. You know for a fact that that is wrong because you already verified that the sparse bundle is encrypted so you can ignore this warning.