Encrypted RAID Disk on OS X Mountain Lion and Mavericks

UPDATE: This works on Mavericks as well

The Disk Utility application does not allow you to create an encrypted filesystem on a RAID volume. However, it is possible from the command line. WARNING: this will erase everything on those disks - do a backup if you want any of that data. The basic method is to create an Apple RAID volume, create a coreStorage logical volume group on it, and then create an encrypted logical volume on the logical volume group.

These are the unformatted disks before RAID.



You can see them from the command line as disk1 and disk2.

$ diskutil list
/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *121.3 GB   disk0
   1:                        EFI                         209.7 MB   disk0s1
   2:          Apple_CoreStorage                         120.5 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
/dev/disk1
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                                                   *2.0 TB     disk1/dev/disk2
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                                                   *2.0 TB     disk2
/dev/disk3
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Macintosh HD           *120.2 GB   disk3

The coreStorage subsystem knows nothing about them yet, and only shows my Macintosh HD.

$ diskutil cs list
CoreStorage logical volume groups (1 found)
|
+-- Logical Volume Group B42959AC-207C-45CE-AC5B-A3B9E5289368
    =========================================================
    Name:         Macintosh HD
    Size:         120473067520 B (120.5 GB)
    Free Space:   0 B (0 B)
    |
    +-< Physical Volume 33B112ED-10BF-452E-BC96-1761AE2FFDC7
    |   ----------------------------------------------------
    |   Index:    0
    |   Disk:     disk0s2
    |   Status:   Online
    |   Size:     120473067520 B (120.5 GB)
    |
    +-> Logical Volume Family BE76718E-765A-4797-B7FD-9B743B6E28E9
        ----------------------------------------------------------
        Encryption Status:       Unlocked
        Encryption Type:         AES-XTS
        Conversion Status:       Complete
        Conversion Direction:    -none-
        Has Encrypted Extents:   Yes
        Fully Secure:            Yes
        Passphrase Required:     Yes
        |
        +-> Logical Volume 46D952CD-311E-476E-8C19-CE2392FBABCE
            ---------------------------------------------------
            Disk:               disk3
            Status:             Online
            Size (Total):       120154296320 B (120.2 GB)
            Size (Converted):   -none-
            Revertible:         Yes (unlock and decryption required)
            LV Name:            Macintosh HD
            Volume Name:        Macintosh HD
            Content Hint:       Apple_HFS

Create a RAID volume from the disks by dragging them into the RAID set and giving it a name (StorageRAID).



Under Options, tell it to automatically rebuild RAID sets if you want to.



Click Create, and then Create again to confirm.



It will create the RAID volume and mount it.



Now back to the command line.

$ diskutil list
/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *121.3 GB   disk0
   1:                        EFI                         209.7 MB   disk0s1
   2:          Apple_CoreStorage                         120.5 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
/dev/disk1
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *2.0 TB     disk1
   1:                        EFI                         209.7 MB   disk1s1
   2:                 Apple_RAID                         2.0 TB     disk1s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk1s3
/dev/disk2
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *2.0 TB     disk2
   1:                        EFI                         209.7 MB   disk2s1
   2:                 Apple_RAID                         2.0 TB     disk2s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk2s3
/dev/disk3
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Macintosh HD           *120.2 GB   disk3
/dev/disk4
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS StorageRAID           *2.0 TB     disk4

You can see that it created a disk4 as the RAID volume. Create a logical volume group named StorageLVG on disk4.

$ sudo diskutil cs createLVG StorageLVG disk4
Password:
Started CoreStorage operation
Unmounting AppleRAID set at disk4
Adding disk4 to Logical Volume Group
Creating Core Storage Logical Volume Group
Switching disk4 to Core Storage
Waiting for Logical Volume Group to appear
Discovered new Logical Volume Group "20D5D037-F88C-4F05-AD28-E569E9564FC0"
Core Storage LVG UUID: 20D5D037-F88C-4F05-AD28-E569E9564FC0
Finished CoreStorage operation

If you do a diskutil cs list now, you'll see the new LVG with the same UUID as above.

$ diskutil cs list
CoreStorage logical volume groups (2 found)
|
+-- Logical Volume Group B42959AC-207C-45CE-AC5B-A3B9E5289368
|   =========================================================
|   Name:         Macintosh HD
|   Size:         120473067520 B (120.5 GB)
|   Free Space:   0 B (0 B)
|   |
|   +-< Physical Volume 33B112ED-10BF-452E-BC96-1761AE2FFDC7
|   |   ----------------------------------------------------
|   |   Index:    0
|   |   Disk:     disk0s2
|   |   Status:   Online
|   |   Size:     120473067520 B (120.5 GB)
|   |
|   +-> Logical Volume Family BE76718E-765A-4797-B7FD-9B743B6E28E9
|       ----------------------------------------------------------
|       Encryption Status:       Unlocked
|       Encryption Type:         AES-XTS
|       Conversion Status:       Complete
|       Conversion Direction:    -none-
|       Has Encrypted Extents:   Yes
|       Fully Secure:            Yes
|       Passphrase Required:     Yes
|       |
|       +-> Logical Volume 46D952CD-311E-476E-8C19-CE2392FBABCE
|           ---------------------------------------------------
|           Disk:               disk3
|           Status:             Online
|           Size (Total):       120154296320 B (120.2 GB)
|           Size (Converted):   -none-
|           Revertible:         Yes (unlock and decryption required)
|           LV Name:            Macintosh HD
|           Volume Name:        Macintosh HD
|           Content Hint:       Apple_HFS
|
+-- Logical Volume Group 20D5D037-F88C-4F05-AD28-E569E9564FC0
    =========================================================
    Name:         StorageLVG
    Size:         2000054943744 B (2.0 TB)
    Free Space:   1999736168448 B (2.0 TB)
    |
    +-< Physical Volume AB193FA5-822F-479B-9D74-AAEC1BC22632
        ----------------------------------------------------
        Index:    0
        Disk:     disk4
        Status:   Online
        Size:     2000054943744 B (2.0 TB)

In diskutil list you can see that it changed the type of StorageRAID from Apple_HFS to Apple_CoreStorage.

$ diskutil list
/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *121.3 GB   disk0
   1:                        EFI                         209.7 MB   disk0s1
   2:          Apple_CoreStorage                         120.5 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
/dev/disk1
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *2.0 TB     disk1
   1:                        EFI                         209.7 MB   disk1s1
   2:                 Apple_RAID                         2.0 TB     disk1s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk1s3
/dev/disk2
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *2.0 TB     disk2
   1:                        EFI                         209.7 MB   disk2s1
   2:                 Apple_RAID                         2.0 TB     disk2s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk2s3
/dev/disk3
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Macintosh HD           *120.2 GB   disk3
/dev/disk4
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:         Apple_CoreStorage StorageRAID            *2.0 TB     disk4

Create an encrypted logical volume on this new LVG.

$ sudo diskutil cs createLV 20D5D037-F88C-4F05-AD28-E569E9564FC0 jhfs+ Storage 100% -stdinpassphrase
Passphrase for new volume:
Started CoreStorage operation
Waiting for Logical Volume to appear
Formatting file system for Logical Volume
Initialized /dev/rdisk5 as a 2 TB HFS Plus volume with a 155648k journal
Mounting disk
Core Storage LV UUID: F490C159-4CAB-463A-BAB8-3A6468CF1FE5
Core Storage disk: disk5
Finished CoreStorage operation

If you look at diskutil cs list now, you'll see the new volume.

$ diskutil cs list
CoreStorage logical volume groups (2 found)
|
+-- Logical Volume Group B42959AC-207C-45CE-AC5B-A3B9E5289368
|   =========================================================
|   Name:         Macintosh HD
|   Size:         120473067520 B (120.5 GB)
|   Free Space:   0 B (0 B)
|   |
|   +-< Physical Volume 33B112ED-10BF-452E-BC96-1761AE2FFDC7
|   |   ----------------------------------------------------
|   |   Index:    0
|   |   Disk:     disk0s2
|   |   Status:   Online
|   |   Size:     120473067520 B (120.5 GB)
|   |
|   +-> Logical Volume Family BE76718E-765A-4797-B7FD-9B743B6E28E9
|       ----------------------------------------------------------
|       Encryption Status:       Unlocked
|       Encryption Type:         AES-XTS
|       Conversion Status:       Complete
|       Conversion Direction:    -none-
|       Has Encrypted Extents:   Yes
|       Fully Secure:            Yes
|       Passphrase Required:     Yes
|       |
|       +-> Logical Volume 46D952CD-311E-476E-8C19-CE2392FBABCE
|           ---------------------------------------------------
|           Disk:               disk3
|           Status:             Online
|           Size (Total):       120154296320 B (120.2 GB)
|           Size (Converted):   -none-
|           Revertible:         Yes (unlock and decryption required)
|           LV Name:            Macintosh HD
|           Volume Name:        Macintosh HD
|           Content Hint:       Apple_HFS
|
+-- Logical Volume Group 20D5D037-F88C-4F05-AD28-E569E9564FC0
    =========================================================
    Name:         StorageLVG
    Size:         2000054943744 B (2.0 TB)
    Free Space:   0 B (0 B)
    |
    +-< Physical Volume AB193FA5-822F-479B-9D74-AAEC1BC22632
    |   ----------------------------------------------------
    |   Index:    0
    |   Disk:     disk4
    |   Status:   Online
    |   Size:     2000054943744 B (2.0 TB)
    |
    +-> Logical Volume Family AC7F549F-1D6F-4E22-B050-34791ABF53FB
        ----------------------------------------------------------
        Encryption Status:       Unlocked
        Encryption Type:         AES-XTS
        Conversion Status:       Complete
        Conversion Direction:    -none-
        Has Encrypted Extents:   Yes
        Fully Secure:            Yes
        Passphrase Required:     Yes
        |
        +-> Logical Volume F490C159-4CAB-463A-BAB8-3A6468CF1FE5
            ---------------------------------------------------
            Disk:               disk5
            Status:             Online
            Size (Total):       1999736168448 B (2.0 TB)
            Size (Converted):   -none-
            Revertible:         No
            LV Name:            Storage
            Volume Name:        Storage
            Content Hint:       Apple_HFS

And in diskutil list.

$ diskutil list
/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *121.3 GB   disk0
   1:                        EFI                         209.7 MB   disk0s1
   2:          Apple_CoreStorage                         120.5 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
/dev/disk1
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *2.0 TB     disk1
   1:                        EFI                         209.7 MB   disk1s1
   2:                 Apple_RAID                         2.0 TB     disk1s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk1s3
/dev/disk2
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *2.0 TB     disk2
   1:                        EFI                         209.7 MB   disk2s1
   2:                 Apple_RAID                         2.0 TB     disk2s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk2s3
/dev/disk3
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Macintosh HD           *120.2 GB   disk3
/dev/disk4
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:          Apple_CoreStorage StorageRAID            *2.0 TB     disk4
/dev/disk5
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Storage                *2.0 TB     disk5

This is what it looks like in Disk Utility after everything is done.