The Importance of Full Disk Encryption
If you leave your MacBook in a coffee shop and it is stolen, the thief does not necessarily need your password to access your data. A sophisticated attacker can simply unscrew the bottom of the laptop, physically remove the hard drive, plug it into a different computer, and copy every single document, photograph, and saved password off the disk in minutes.
To prevent this catastrophic security breach, Apple built FileVault directly into macOS. FileVault performs real-time, military-grade XTS-AES-128 encryption on your entire hard drive. If the drive is stolen, the data is mathematically scrambled and completely unreadable without your exact login password or a highly specific Recovery Key.
While average users can manage FileVault through the graphical System Settings menu, IT administrators deploying dozens of Macs to remote employees need a way to manage encryption silently and programmatically via deployment scripts. The only way to interact with FileVault from the terminal is by using the fdesetup (Full Disk Encryption Setup) command.
Step 1: Open the Terminal
Because you are interacting with core security and disk encryption protocols, you must run these commands as a root administrator.
- Press Command + Space to open Spotlight Search.
- Type
Terminaland press Enter.
Step 2: Checking Encryption Status
Before you deploy a new Mac to a high-level executive, you must verify that FileVault is actually turned on and actively protecting the data.
sudo fdesetup status
The terminal will output a very simple, binary response: “FileVault is On.” or “FileVault is Off.”
If the encryption process is currently happening in the background, it will output a progress percentage (e.g., “Encryption in progress: 45%”).
Step 3: Enabling FileVault from the Terminal
If a remote employee’s Mac shows that FileVault is off, you can force it to turn on without making them click through the System Settings menus.
sudo fdesetup enable
The command will prompt you to enter the active user’s password. Once verified, it will instantly begin encrypting the hard drive in the background.
Crucially, the terminal will instantly output a 24-character Personal Recovery Key. If the employee ever forgets their login password, this key is the only way to save the data from permanent deletion. You must copy this key and store it in a secure corporate password vault immediately.
Step 4: Checking Authorized Users
In macOS, simply having a user account does not automatically give you the ability to unlock an encrypted hard drive when the Mac is first booted up. Only specific, authorized users are allowed to bypass the FileVault lock screen.
To see exactly which users are currently authorized to unlock the drive, run:
sudo fdesetup list
This outputs a list of usernames alongside a long alphanumeric identifier (a UUID). If an employee complains that they cannot log in immediately after a reboot, it is usually because their username is missing from this authorized list.
Step 5: Managing the Recovery Key
If a former IT administrator wrote down a Mac’s Personal Recovery Key on a sticky note and left it on a desk, that key is compromised. You must instantly generate a brand new key to secure the laptop.
sudo fdesetup changerecovery -personal
macOS will securely destroy the old recovery key and instantly generate a brand new 24-character string on the screen. The old sticky note is now completely useless, ensuring the corporate data remains secure.