Mac – How does Time Machine encrypt backups to network disk


I see other questions regarding encrypting Time Machine backups to external disks, like this one:

If I encrypt a Time Machine backup disk, is the entire disk encrypted or just the Backups.backupdb directory?

There it says the entire disk is encrypted.

But for a network disk, I find it hard to believe that Time Machine can encrypt the disk. For example, is remote encryption of an entire disk possible via SMB?

Of course, Time Machine still supports encryption to a network drive, so then what exactly is it doing?

Best Answer

Neither the remote disk nor the remote volume is encrypted by Time Machine. Instead a special "sparse bundle (disk image)" ("backupbundle" for Catalina) is created on the network drive. In fact it's no uniform disk image file like a dmg but a special folder containing sub-folders and config/log files.

The content of the source volume(s) is saved as AES-128-encrypted band (or chunk) files in the bands folder.

The password is merged into a special file named token in the backupbundle.

The remote disk or volume could be encrypted independently though. This depends on the (TM-)server config.