binaryfactory.ca

How does Time Machine work with FileVault?

To restore individual files, you can mount the Time machine sparsebundle files and browse them. I believe Apple should document this better, I have yet to find a clear precise document describing how it works.

Here’s a test:

I ran a backup manually. It backed up about 265megabytes. This was right after iTunes downloaded an update for my iPhone. This is weird, because that is stored in Library/iTunes/iPhone Software updates, which is in my FileVault user data.

I ran a second backup right after. It backed up 726Kb. Sounds like not much has changed.

Then, I copied a folder (mp3 album) from my NAS to a folder called Time Machine Test in my home folder.. 91megabytes of files.

I started a backup. Sure enough, it backed up about 91megabytes.

After the backup completed, I mounted the Sparsebundle file, and my files were there. I could copy them back properly.

Manually retrieving files from a Time Machine Sparsebundle with FileVault

So Apple, HOW does it REALLY work? What only gets backed up at logoff? Why can’t the UI show me those files and let me restore them when I can mount the sparsebundle and do it myself?

Having issues similar to:

Trying to enable EFS on a specific OU, while it’s disable at the top of the structure or domain?
Recovery certificates from two different GPOs mixing up instead of being replaced?

Overall EFS GPOs looking like they aren’t merging properly?

Well, it’s not because EFS GPOs are supposed to behave like black magic. Turns out there’s a bug, Microsoft’s aware of it, but doesn’t think it would be a good idea to FIX IT on Windows XP and 2003.

Thankfully, all it means is you need to edit your GPOs from a Vista, 2008 or Windows 7 machine.

KB : EFS may not be enabled expectedly after you disable a policy and this policy turn off the EFS feature

Opening my EFS GPOs in Windows 7, switching the Allow/Don’t allow and applying the ‘change’ fixed my GPOs. A few minutes later, and stuff was behaving like it should’ve been… Can I have those wasted hours of my life back, Mr. Ballmer?