Apple recently announced that macOS 28, expected to be released in just over a year, will remove support for encrypted HFS+ volumes. What hasn’t been clear is whether that also applies to encrypted HFS+ disk images, which could have much wider impact. This article tries to clarify that.

Encrypted HFS+

Until 2011, the Mac Extended File System HFS+ had no support for volume encryption. When the first version of FileVault was released eight years earlier, it was only able to protect Home folders, and that was achieved using encrypted disk images. Rather than changing the HFS+ file system, Apple added a logical volume manager, CoreStorage, to implement whole-volume encryption. CoreStorage was also used extensively for Fusion Drives.

This is different from APFS. When that was introduced in 2017, encryption was built into the file system itself, so there was no need for CoreStorage. Since then, those requiring the protection of encryption, for example in storage of backups, should have switched to using APFS Encrypted volumes, as has Time Machine.

Encrypted disk images

Disk images have their origins in Classic Mac OS, and have been available in encrypted variants since at least Mac OS X 10.1 in 2001. Although they have evolved considerably since then, they have worked by encrypting the disk image itself, rather than by attempting to encrypt the virtual file system within it.

As a result, encrypted disk images offer encryption as an option for most of their many different formats, and its availability and implementation is independent of the file system supported. This applies equally to those using APFS, in which it’s the disk image that is encrypted rather than using the APFS Encrypted file system.

As encrypted disk images have never used CoreStorage, withdrawal of support for that has no impact on the continued use of any form of encrypted disk image, including those using HFS+ as their virtual file system.

Encrypted HFS+ disks

Apple has most recently amended its article about this change to include details of in situ conversion from Encrypted HFS+ to APFS Encrypted format. For many this may be the simplest option, although for archives of important files, this should only be attempted after a backup copy has been made, in case the conversion fails and damages the file system. While that’s exceedingly unlikely (the conversion is derived from that used in the transition to APFS), it’s good insurance.

However, Apple warns such conversion “doesn’t apply to encrypted Time Machine backup disks”. To an extent that should be obvious, as Time Machine backs up to APFS using different methods based on snapshots. Its HFS+ backups are incompatible with APFS as they rely on directory hard links, which aren’t available in APFS. What may not be so apparent is that attempting to perform in situ conversion to APFS is high risk and unlikely to be successful, so shouldn’t be attempted on Time Machine backups on HFS+.

In situ conversion to APFS has been used most extensively on macOS startup disks, as that was how we switched to the new file system when it was released in 2017-2018. Its track record there is exceedingly good, but not perfect. The structure of Time Machine backups to HFS+ is radically different, with a single volume containing millions of hard links, many of them directory hard links that can’t be directly converted to APFS. Expecting successful conversion is thus wildly overoptimistic, and decryption might be more likely to succeed.

Summary

• Removal of support for encrypted HFS+, due in macOS 28 next year, doesn’t affect access to or use of encrypted disk images.
• Although in situ conversion from encrypted HFS+ to APFS Encrypted may prove an effective solution for disks used for general storage, it’s unlikely to succeed on Time Machine backups.

Further reading

man hdiutil
What to do with your encrypted HFS+ disks
Explainer: Disk encryption