Securing sensitive client records, cryptographic keys, and financial spreadsheets on macOS requires encrypted storage volumes that remain independent of cloud synchronizations and device backups. While Disk Utility provides a graphical wizard, automation scripts, backup daemons, and system administrators rely on hdiutil (Hard Disk Image Utility). The hdiutil command-line framework offers complete programmatic control over creating, mounting, compacting, resizing, and converting military-grade AES-128 and AES-256 encrypted disk images.
Choosing the Right Disk Image Architecture
Before creating an image, select the format best suited for your storage and backup workflow:
| Format Switch | Format Type | Internal Structure | Primary Advantage |
|---|---|---|---|
UDIF / UDZO |
Standard DMG (.dmg) | Single flat file with fixed capacity. | Ideal for archiving and distributing read-only software packages. |
SPARSE |
Sparse Image (.sparseimage) | Single file that grows dynamically as data is added. | Saves initial disk space. |
SPARSEBUNDLE |
Sparse Bundle (.sparsebundle) | Directory package containing small 8MB band files. | Optimal for backups (Time Machine, rsync, cloud syncs only modified bands). |
Creating an AES-256 Encrypted Sparse Bundle
To create a dynamically expanding encrypted volume with an APFS filesystem and a maximum virtual capacity of 50 GB:
hdiutil create -size 50g -encryption AES-256 -type SPARSEBUNDLE -fs APFS -volname "SecureVault" ~/SecureVault.sparsebundle- Terminal prompts securely: “Enter a new password to secure ‘SecureVault.sparsebundle’:”
- Type a strong passphrase and confirm it.
hdiutilinitializes the encrypted band directory structure in your home folder.
Attaching (Mounting) and Detaching Disk Images
To mount your encrypted volume from Terminal:
# Mount the encrypted image
hdiutil attach ~/SecureVault.sparsebundlemacOS prompts for your passphrase (or reads it from your macOS Keychain if previously stored). The volume mounts under /Volumes/SecureVault, appearing in Finder just like an external flash drive.
To unmount the volume once you have finished editing sensitive documents:
hdiutil detach /Volumes/SecureVaultCompacting Reclaimed Space in Sparse Bundles
When you delete large files from an unencrypted or encrypted sparse bundle, the physical file on your Mac does not shrink automatically. Use the compact subcommand to reclaim empty blocks:
# Ensure the image is unmounted before compacting
hdiutil compact ~/SecureVault.sparsebundlehdiutil scans the underlying 8MB band files, identifies empty sectors, and deletes abandoned band blocks, freeing gigabytes of host SSD capacity.
Converting and Resizing Disk Images
To expand the maximum virtual capacity of an existing sparse bundle from 50 GB to 100 GB:
hdiutil resize -size 100g ~/SecureVault.sparsebundleTo convert an unencrypted folder into a compressed, read-only DMG file suitable for secure deployment:
hdiutil create -srcfolder ~/Projects/Release -format UDZO -encryption AES-128 ~/Release_Installer.dmgUsing hdiutil allows macOS power users to build automated security vaults, optimize backup bandwidth, and manage encrypted filesystems with terminal precision.