Synk Icon

Using FileVault With Synk

FileVault is Apple's solution for securely encrypting your home folder to protect its contents if your computer is stolen. Enabling FileVault creates an encrypted disk image (just like the ones you can create using Disk Utility) that's automatically mounted by the system when you log in and unmounted when you log out.

If you're just syncing or backing up data inside your FileVault protected home folder, everything will pretty much work just like normal. The only thing you need to be aware of is that your home folder doesn't exist while you're logged out, so Synk can't do anything with it unless you're logged in. (You technically could give Synk the password to the encrypted disk image, but that would be a very bad idea, because you may not be able to log in if the disk image were already in use by Synk.) Since Synk 7 works live, this generally isn't a problem, but if you only connected a backup drive while the FileVault user was logged out, that script wouldn't ever have a chance to run.

If you're doing a bootable backup, or in some other way trying to work with the home folder as a whole, things are somewhat more complicated. As of this writing (10.6.6), Mac OS X stores the disk image at e.g. /Users/filevaultuser/filevaultuser.sparsebundle. When you log in, it moves this to /Users/.filevaultuser so that the disk image can be mounted at /Users/filevaultuser. So, if you just do a bootable backup like normal, you'll end up copying the disk image under filevaultuser whenever you're logged out, then when you're logged in that image will be deleted, copied again under .filevaultuser, and the contents of your home folder copied directly from the newly mounted home folder.

There's unfortunately not really a great solution to this. Even Apple's own Time Machine doesn't really work very well with FileVault, and will only back up a FileVault when the user is logged out.

Our recommendation for use with Synk 7 is to go the opposite direction: only back up when the user is logged in, reducing it to the simpler situation given above that works fine. For bootable backup purposes, you should create a user that doesn't use FileVault so that you can log in when booted from the backup, and for the bootable backup script you should exclude both the /Users/filevaultuser and /Users/.filevaultuser paths. Then, in a separate script, do a backup of just the contents of your home folder.

Related Topics