Encrypting an External Drive

First, check to see if your drive is already encrypted:

1. Connect your external drive to your computer. If prompted, Allow the accessory to connect.
2. Open Disk Utility. One way to do this is to click the Spotlight Search magnifying glass (), type “Disk Utility” and hit Return on your keyboard.
   
3. Find and select your external drive from the menu on the left side of the window.
4. Under the drive name, you will see the file system format, “APFS” in the example below. If you see “(Encrypted)” or “(Case-sensitive, Encrypted)” to the right of the file system format, your drive is already encrypted, and you are all set.
   
5. If your drive is not “Encrypted”, back up any data stored on that drive elsewhere, and continue to the Formatting your External Drive for Encryption section.

Once your data has been backed up, see Apple’s Encrypt and protect a storage device with a password in Disk Utility on Mac article. The recommended format to choose during those instructions is APFS (Case-sensitive, Encrypted). If you use those instructions and choose that file system format, there are no additional steps to encrypt your drive.

If your drive is currently unencrypted and is formatted with an acceptable file system, you may be able to use these steps to encrypt the drive without erasing the data. Creating a backup of the data first is still recommended.

1. Any external drives connected to your computer should appear as an icon on your Desktop. The external drive in the example below is named “FLOATER”.
   
2. Right click on the external drive you would like to encrypt, then select Encrypt….
3. Enter a secure, memorable Encryption password, Verify the password by typing it a second time, optionally enter a Password hint, then click Encrypt Disk.
   
   Don't forget your password!

   While FileVault Recovery Keys can be generated for UVM-managed machines, those keys will not work to unlock your external drive, and Recovery Keys cannot be generated for external hard drives.

4. The drive should now proceed through the encryption process. Verify the drive is encrypted by following the steps in the Check your External Drive Encryption Status section above.

If your drive is improperly formatted, in addition to limitations reading and writing to the drive, encryption may be impossible.

1. Attach your external drive to your computer.
2. Open Disk Management. One way to do this is to expand the Start Menu (), type “disk management“, and hit Enter on your keyboard.
3. Disk Management shows all the storage volumes attached to your computer. One of those volumes is likely Windows (C:) and you’ll likely see that the File System for that volume is NTFS (BitLocker Encrypted). That volume is the main drive in your computer that holds the Operating System and likely the majority of your data. Another volume on the list will be your external drive. Use the Capacity column and possibly the Volume column (if you computer can read it) to narrow down the correct row. The File System column for that row will either be blank (meaning Windows cannot read the volume) or it will list the file system format of your drive.
   1. If the File System column is blank, that means your computer cannot read the drive, and you have to format the drive to continue. This means all the data on the drive will be erased! Proceed to the Formatting your Drive for BitLocker section below.
   2. If the File System is NTFS (BitLocker Encrypted) or FAT32 (BitLocker Encrypted), your drive is already encrypted, and you are all set.
   3. If the File System is anything else, proceed to the Encrypt with BitLocker section below.

1. The Disk Management window should still be open from the previous steps. Highlight the volume that you would like to format. You’ll see that when you highlight a volume, the corresponding rectangle below gets shaded in.
   
2. Right-click the rectangle corresponding to the volume to be formatted, and select Delete Volume.
   
3. Confirm that you would really like to format the drive, erasing all data, by clicking Yes.
   
4. Right-click the same rectangle again, now called “Unallocated“, and select New Simple Volume….
   
5. Click Next 3 times.
6. On the Format Partition screen, select your desired File system format.
   1. FAT32: Choose this file system format if you need to access this drive across both Macs and PCs.
   2. NTFS: Choose this file system format if you only need access to this drive from Windows PCs.
7. Choose a descriptive but concise Volume label (a name for the drive), and click Next.
   
8. Click Finish.

1. Open Windows Explorer, right click the external drive to be encrypted, then select Turn on BitLocker.
   
2. Select Use a password to unlock the drive, enter a secure and memorable password, then click Next.
   
   Don't forget your password!

   While BitLocker Recovery Keys can be retrieved for UVM-managed machines, those keys will not work to unlock your external drive, and Recovery Keys for external drives cannot be stored in your UVM Microsoft account.

3. Click Print the recovery key. Select the Microsoft Print to PDF printer to save the recovery key to your computer. Select a real printer or print queue instead if you would rather save the key to a piece of paper. The recovery key can be used if you forget your password. Click Next.
   
   Don't lose your recovery key!

   Store your recovery key in a secure location. Do not store the recovery key on the encrypted drive that it unlocks.

4. Read through this page and select how to encrypt your drive, then click Next. 
5. Read through this page and Chose which encryption mode to use. Click Next.
6. Click Start encrypting.
   
7. Wait until the encryption has finished, and then click Close.