OS X / macOS: Creating Encrypted Disk Image Files

Created on: June 24, 2020
Last updated: June 24, 2020

Note: This article was adapted from the related Rocket Yard feature by OWC Contributor, Tom Nelson. It is supplied here as a courtesy to customers who prefer to search our MacSales Knowledge Base for the help they need.

Introduction

At different times you may find it necessary to share data, software, or other digital content with friends or colleagues using OS X / macOS Disk Images. The most commonly used variant — the .DMG file — serves a similar purpose as a .zip archive file (used in both the Mac and PC worlds). Typically disk images are not secured in the sense of being password protected or the like. However it is possible to create encrypted disk image files, and that's what this support article is about.

Encrypted disk images allow you to protect the content being shared, allowing only authorized individuals to see it. Encrypted disk images can’t be mounted, viewed, or accessed unless you know the password associated with the image file. Here we will look at how to this specific kind of disk images. We’ll start with an overview of the basics of disk images and encryption, and then move on to specific steps, including differences between different OS X / macOS versions.

Encryption Type
Disk images support two types of encryption: 128-bit AES (Advanced Encryption Standard) and 256-bit AES. The two levels refer to the size of the keys used in the encryption nd decryption processes. The 256-bit method is more secure than the 128-bit option, but also takes longer to encrypt and decrypt. For the most common use cases, 128-bit encryption will provide enough security and peace of mind, while the 256-bit method is a better choice for mission-critical data.

Mounting an Encrypted Disk Image
Before you can use of a disk image it needs to be mounted, so your Mac can access the data. Mounting an encrypted disk image isn’t much different than mounting a normal disk image; simply double-click the disk image file, or right-click and select Open... from the contextual menu. Before an encrypted disk image mounts, OS X / macOS will display a window that requests a password, granting access to the information stored in the image. Enter the password then click OK.

Unmounting the Disk Image
Unmounting an encrypted disk image returns it to an encrypted state, preventing access to the stored data. You can unmount a disk image by dragging its Desktop icon to the trash, by selecting it and pressing Cmd-E, or by right-clicking on the image and selecting Eject from the context menu.

Image Formats
Disk Utility supports several disk image formats (important: this is separate from file system formats like HFS+, APFS, or NTFS). Not all of the following formats are available in every version of Disk Utility, or can be used with every method of creating disk images, but it's useful to be aware of the options. Note that not all of these will be available in every version of the OS. This setting is shown later again, as we create the disk image.

  • Read only: Allows the content of a disk image to be opened and read. Additions to the image or changes to any of the files are not allowed. The Read Only option is only possible when creating an image from a folder or drive, or when converting from one format to another.

  • Read/Write: Mentioned earlier, this commonly used format lets you to add files to a disk image after it is created. Note however, the maximum capacity of the image file is predefined and can’t be modified once created. Read/Write image files use the extension .dmg

  • Compressed: This variant is similar to the Read Only option, but any free space is first removed in order to reduce the size of the file. Like Read Only, this option can be used only when creating an image from a folder or drive, or when converting from one image format to another.

  • Sparse Image: This disk image format allows the image size to expand or be reduced, in order to accommodate the amount of data stored. The maximum size the image can grow to is set during the image creation process. An important difference is that the Sparse Image format use a different file extension — .sparseimage

  • Sparse Bundle: This format is made from multiple small files, usually less than 8 MB in size. When the stored data changes, only the file(s) that contains the changes needs to be changed, created, or deleted. Similar to the Sparse Image format, a Sparse Bundle's file size can also expand or decrease as the amount of data increases or decreases. Sparse Bundle files are commonly used with Time Machine and use their own extension type as well — .sparsebundle

    • Note: The two sparse image formats have a maximum size that you set during creation. This is the size the image file will appear to have when mounted on your desktop. The actual image file (the .sparsebundle or .sparseimage file) will only use the amount of space needed to hold the data within.

  • DVD/CD master: This variant is used for mastering CDs or DVDs. If you’re using OS X El Capitan (10.11) or later, when this format is selected, the image size field will change to a dropdown menu and default to the value 177 MB (CD 8 cm). Use this menu to select any of the standard optical disc sizes. If you’re using OS X Yosemite (10.10 or earlier, you must manually change this field to one of the standard DVD/CD sizes. This format uses the file extension: .cdr

  • Hybrid image (HFS+/ISO/UDF): This image format is used for creating a single image whose files can be used on multiple platforms.

How to Generate a Blank Encrypted Disk Image
1. Launch Disk Utility (found in Applications > Utilities)

Options for creating a new blank disk image are displayed

An example of settings used for a new blank disk image, shown here in macOS High Sierra (10.13).

2. If you’re using OS X Yosemite (10.10) or earlier, select File, New, Blank Disk Image. You can also select New Image from the Disk Utility toolbar.

If you’re using OS X El Capitan (10.11) or later, select File, New Image, Blank Image. A New Blank Image window will open, with various fields and menus to allow you to customize the disk image you will create.

3. Choose the required settings and options:

  • Save As: Provide a name for the disk image file. Do not include the file extension; it will be added automatically.

  • Tags: Enter any Finder tags for the image file. Available only with Mavericks (10.9) or later.

  • Where: Use the menu to select the location where the file will be saved. OS X El Capitan (10.11) and later uses the standard Save As dialog box, though you can use the dropdown menu method by clicking the chevron icon.

  • Name: This is the name of the disk image when it is mounted.

  • Size: Use the dropdown menu to select a size for the image. The dropdown menu is prepopulated with sizes commonly used. You can also select the Custom option in the menu and enter any size you wish. OS X El Capitan and later uses a Size field that allows you to enter the size you wish to use in MB or GB.

  • Format: (shown below) use the menu to select one of the available volume formats. If you plan to use this image with PCs, select either MS-DOS (FAT) or ExFAT. If you’re only going to use this encrypted image with a Mac, Mac OS Extended (Journaled) is a good choice. This format applies to the image file and not the mounted image. macOS High Sierra (10.13) and later also provide the APFS format.

Disk images need a format to use just as drives need to be formatted.

  • Encryption: Use the dropdown menu to select None, 128-bit AES, or 256-bit AES encryption. In OS X El Capitan and later, you’ll be asked to create and verify a password once you select an encryption type.
  • Partition Map: this menu provides the following options, depending on OS version (10.13 shown below):

    • No partition map: Useful only for very old Macs (running OS 9 and earlier).
    • Hard Disk: generic disk option available in 10.10 and earlier.
    • Single Partition CD/DVD: Generic CD/DVD format used in 10.10 and earlier
    • Single Partition CD/DVD with ISO data: Used for hybrid CD/DVDs in 10.10 and earlier.
    • CD/DVD: Generic CD/DVD format used in 10.11 and later.
    • Single partition – Apple Partition Map: For PowerPC Macs
    • Single partition – Master Boot Record Partition Map: For PCs
    • Single partition GUID Partition Map: For Intel Macs
Use the Partition Map dropdown list to select one of the available partition types to use

Select a Partition Map setting to reflect the type of OS and/or device that will be used.

  • Image Format: this menu provides the following options, depending on OS version (10.10 shown below):
    • sparse bundle disk image
    • sparse disk image
    • read/write disk image
    • DVD/CD master

Disk Utility supports a number of image formats

4. Click the Create button (10.10 and earlier), or the Save button (10.11 or later).

In 10.10 and earlier, a password dialog like the one below will be displayed.

Early versions of the disk image tool included a password strength bar graph

Early versions included a password strength bar graph. Later versions only show the strength graph when the lock key icon is used for generating a password.

  • Password: Enter a password to use for this image.
  • Key icon next to Password field can be used to open the Password Assistant, which can be used to generate a password based on your choices.
  • Verify: Re-enter the password.
  • Password Strength: A bar graph displays how good the password is, based on length and types of characters used.
  • Keychain can remember your password for the disk image. Place a checkmark in the box labeled 'Remember password in keychain.'

5. Once you’ve entered and verified a password, click the OK button. Disk Utility will create the disk image and mount it on the Desktop.


Create a New Image from a Folder
Disk Utility also allows you to create a new disk image that will contain the contents of a selected folder or directory. This allows you to bypass the process of adding files manually after the disk image is created. It also allows you to create Read Only disk images that can’t easily be modified.

The process is nearly identical to the one used for creating a new blank image. The main differences are at Step 1:

  • If you’re using 10.10 or earlier, select File, New, Disk Image from Folder.
  • If you’re using 10.11 or later, select File, New Image, Image from Folder.

A window will open, allowing you to browse to and select a folder to use for the new image.

2. Once you’ve selected a folder, click the Image button (10.10 and earlier), or the Choose button (10.11 or later).

The New Image from Folder window will open; it’s very similar to the one used for selecting options for creating a blank disk image. The difference is in the available disk image format options:

  • Read-only
  • Compressed
  • Read/write
  • DVD/CD master
  • Hybrid image (HFS+/ISO/UDF)

3. Make your selection and click the Create button (10.10 and earlier), or the Save button (10.11 or later).

When you convert a disk image or create a disk image from a folder, the image formats available are limited

When you convert a disk image or create a disk image from a folder, the image formats available are more limited.

Convert Disk Image
You may find that once you’ve created and used a disk image for a while, the format or encryption options you selected need to be changed. Disk Utility can convert an existing disk image to the following formats:

  • Read only
  • Compressed
  • Read/write
  • DVD/CD master

The Encryption setting can be changed to None, 128-bit AES, or 256-bit AES.

To convert a disk image, first make sure the image is unmounted, then launch Disk Utility and select Images, Convert.

In the Convert window that opens, browse to the location of the image file you wish to convert, select the image, and then click the Convert button.

The Convert dialog box is, in many aspects, just a mini version of the image creation window. Provide a name for the converted image file, a location to store the file, and then use the Image Format dropdown menus to select a format to change to, and the Encryption dropdown menu to select an encryption type to use. When you ‘re ready, click the Save button.