Crossing a Border With a Mac: What Protects Your Files?

The situation

You are about to cross a border with a laptop that holds work, family photos and documents. You want to know what you can do beforehand, and what a lock on your files can and cannot do.

Technology answers one question: can someone read the files without the key? It does not answer what you may be asked to do, or what follows if you refuse. Keep those two questions apart.

Before you travel

1. Carry less

   Move what you do not need on the trip to an encrypted backup at home, or leave it there. What is not on the device cannot be read from it.

2. Back up first

   Make a Time Machine backup before you leave and keep the disk at home. Apple says an external backup disk without encryption can be read by anyone who has it, so encrypt the backup. Then a lost or seized Mac is an inconvenience, not a disaster.

3. Turn on FileVault

   Open System Settings > Privacy & Security > FileVault. The turn on or off FileVault guide has the steps. Apple says that once FileVault is on, your credentials are required during startup.

4. Store the recovery key away from the Mac

   Apple says to store a recovery key somewhere safe, but not in the same physical location as your Mac. Write it down or keep it in a password manager you can reach from home. See the recovery key guide. Do not carry it with the laptop.

5. Shut the Mac down before the checkpoint

   Choose Apple menu > Shut Down. Apple says a Mac is completely shut down when the screen is black, and a laptop should finish shutting down before you close the display. A Mac that is off is back to the state where it needs your login password or recovery key to start. Apple also says Touch ID does not replace the password after a shutdown or restart. Sleep is not the same thing.

6. Read the rules for each country

   Official travel or civil-liberties guidance for each country on your route is better than advice from strangers online.

What FileVault covers, and what it does not

Apple says that with FileVault on, the internal volumes stay encrypted without valid login credentials or a recovery key, even if the storage is moved to another computer. That is the protection you get from a Mac that is switched off.

More on the difference: FileVault vs a folder vault and what FileVault is.

Where a vault and duress mode fit

Hidden Folder is designed so that hidden vaults show no list, and a pattern that matches nothing opens an empty vault, not an error. A planned duress mode goes further: one designated pattern opens a decoy vault and, in the background, removes the other vaults' index, storage and local recovery entries from that Mac.

The design admits its limits. The spec lists someone watching you draw the pattern, forensics on flash storage after deletion, and an observer timing the duress unlock with instruments as things it does not protect against. It also says deletion does not overwrite data, because that is not reliable on SSDs. Encrypted iCloud backups and copies on other devices are kept.

Think before you use duress mode

The spec asks for a strong warning when you set it up and suggests testing with dummy vaults first. An empty vault also may not look believable to every observer. No design can promise that.