I'm trying to get all of our laptops doing FDE (as I'm sure lots of you are), and I've run into a problematic spot. Our Windows and Linux laptops are Dells, and they have some good BIOS integration with the Seagate drives (such as the ST9160314AS). That's working well. However, on the Mac, the BIOS support (well, EFI support) just isn't there.

A coworker tried WinMagic, which claims to support these drives, but have a slew of issues that killed the project at the time (lockups, slow OS, bad interaction with FileVault). I'd really like to get it working.

Is there anything that will work for me? FileVault is better than nothing, but it slows the machines down noticeably when doing heavy IO (which is common for our users, being Java developers). One of the available software FDE packages (such as PGPDisk) would probably work, but I doubt it would be much faster than FileVault.

Also, if someone with some rep could create some tags for me (fde, winmagic, filevault), that would be awesome.

  • 1
    Hi @Bill, as you see the disk-encryption already exists. No need to create such specific product-tags, there's not enough questions on each of those to populate the tag... Besides, we usually deal here in principles, and the choice of winmagic (which you dont want anyway :) ) is mostly irrelevant to the principle of the question. – AviD Jan 4 '11 at 11:29
  • Ah, I didn't even look for disk-encryption, I started with full. Thanks. – Bill Weiss Jan 4 '11 at 16:27

WinMagic is the only one I know that even claims to support hardware encryption, and they claim to be the only one to support Seagate Momentus drives. The Sophos/Utimaco and PGP products don't support hardware-encrypted drives, and TrueCrypt can't encrypt the boot volume.

By the way, I worked on implementing one of the FDE products listed above, and while I'm no longer associated with that company I would still advise that FDE is a better choice than FileVault. Without getting too nerdy on the details, FileVault has a kernel-userspace communication that acts as a measurable bottleneck and even causes deadlocks in some heavy-use situations. Also, it clearly doesn't protect data written outside the home folder, e.g. to the default temp location in /var/folders. Conversely, the FDE software encryption is typically all done block-at-a-time inside a kernel extension, and the vendors know that they'll get destroyed in reviews if it slows anything down :-)

As described in Apple's marketing blurb, there will be built-in full disk encryption in OS X version 10.7.

  • Don't worry, I'm on-board with the FDE. The performance of FileVault isn't anything to get excited about. – Bill Weiss Jan 4 '11 at 16:25
  • 2
    There's FileVault 2 now, it encrypts entire drive. – Display Name Jun 27 '14 at 15:13

FWIW PGPDisk works ok on Mac OSX in my experience, had it running on a MacBook Pro with Leopard without any major issues (although I wasn't doing much in the way of heavy development with it, so hard to guage the performance hit)

  • Good to know. I'd really like to see hardware encryption, but I'll look at PGPDisk if I resign myself to software :) – Bill Weiss Jan 4 '11 at 16:27

PGP's WDE (Whole Disk Encryption) works pretty well. Its worth noting that you can use a drive encrypted with PGP WDE as a local Time Machine backup drive, allowing a fully encrypted continuous backup solution. Note - use a complex password to encrypt the drive, NOT a key.


Current-day answer: use FilveVault 2 and SSDs. It's fast enough and works quite well. Enterprisey management isn't the best, but if it can work for you it's better than the third-party alternatives.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.