Manage FileVault

Question 1

How does FileVault protect user data?

Answer 1

FileVault encrypts the startup volume to protect user data.

Question 2

What are the differences between full-system encryption and full-disk encryption and the way that
FileVault performs with each?

Answer 2

The difference between full-system encryption and full-disk encryption and the FileVault requirements
for each are listed below:
• Full-System Encryption—Used in Mac computers with a T2 chip.
Full-system encryption is automatic and integrates the function of several controllers that other Mac
computers use. In this case, FileVault should be turned on for additional security, because without
FileVault enabled, your encrypted SSDs will automatically mount and decrypt when connected to
your Mac.
• Full-Disk Encryption—Used in Mac computers without a T2 chip.
FileVault uses full-disk encryption to help prevent unauthorized access to the information on your
startup disk. FileVault performs the encryption at the file system driver level of macOS.

Question 3

How can you turn on FileVault if you didn’t turn it on when you were prompted by Setup Assistant?

Answer 3

You can turn on FileVault at any time from Security & Privacy preferences.

Question 4

What are the two ways you can save the FileVault recovery key when you enable FileVault in Security &
Privacy preferences?

Answer 4

FileVault Recovery offers two ways to recover passwords if FileVault passwords are lost:
a. Use your Apple ID to unlock the FileVault volume and reset your password. This generates a random
FileVault recovery key and saves it to your iCloud account on Apple servers.
b. Record the key that FileVault randomly generates. You must keep the key letters and numbers
somewhere safe and not on your encrypted startup disk.