your encrypted mac means nothing if the backup drive isn't

your mac is a vault. your backup drive might be a shoebox

you turned on filevault years ago, forgot about it, and feel good knowing your macbook is encrypted end to end. meanwhile that time machine drive sitting next to your monitor, the one with every version of every file you've ever had, is probably sitting there in plain readable format. anyone who walks off with it can plug it into any mac, any pc with the right driver, and just... read everything. no password, no decryption, nothing. let's fix that.

step one: find out where your backups actually go

a lot of people don't even remember which drive time machine is backing up to, especially if you've swapped drives over the years. open terminal and run:

tmutil destinationinfo

this spits out the name, mount point, and disk identifier of whatever drive time machine is currently targeting. you're looking for a line like name and identifier, something like disk4s2. write that identifier down, you need it for the next step.

step two: check if it's actually encrypted

having a password on your mac doesn't mean the external drive got the memo. run:

diskutil info /dev/disk4s2

swap in whatever identifier you got from the last command. scroll down to the line that says filevault. if it says no, that drive is wide open. anyone with physical access can mount it on another machine and browse your entire backup history like a filing cabinet with no lock. yes, that includes old documents, deleted files that are still in past snapshots, browser data, everything.

this is the part people skip because the mac itself feels secure, so they assume everything connected to it inherits that security. it doesn't. encryption is per volume, not per vibe.

step three: turn encryption on the right way

you don't need terminal for this part. go to system settings > general > time machine, click the drive you use, and look for the option to encrypt backup. if it's already added as an unencrypted destination, you may need to remove it and re-add it to get the encryption prompt, or encrypt it directly through disk utility by selecting the drive and choosing encrypt from the file menu.

heads up: encrypting an existing backup drive usually means starting a fresh backup. there's often no clean way to encrypt in place without wiping it. annoying, yes, but a fresh encrypted backup is infinitely better than an old open one. back it up, wipe it, encrypt it, let it start over.

step four: don't lose the passphrase

filevault on an external drive asks for a password separate from your mac login. if you lose it, that backup is gone forever, no recovery, no apple support magic. the second you set it, drop it into your password manager immediately. don't write it on a sticky note, don't "remember it later." later is where good intentions go to die.

why this actually matters

think about who actually gets access to a backup drive versus the laptop itself. laptops get stolen, sure, but backup drives get lost in moves, left in old desk drawers, sold at garage sales, donated, or just borrowed by a roommate who wants extra storage for a weekend. every one of those situations is a full data exposure if the drive isn't encrypted, and most people never even think to check because the whole point of a backup is that you forget it exists until you need it.

the takeaway

run tmutil destinationinfo, grab the identifier, run diskutil info on it, and look at that one line for filevault. if it says no, go flip it to yes through time machine settings, save the passphrase somewhere real, and stop treating your backup drive like it's immune to the same rules as everything else. your mac being encrypted was never the full story. the backup was always the quiet exception, until now.