Dave Nanian:

Recent versions of xOS (that is, macOS, iOS, iPadOS, etc) have Data Protection Classes from A to D that get assigned to files and folders.

[…]

The thing is, though, is that these files and folders are inaccessible unless the user is logged in, and the screen is unlocked. A few seconds after the screen locks (or you log out), the keys are purged, and they cannot be read.

[…]

That means the files any application considers to be worth protection cannot be accessed when a backup usually happens.

[…]

You may have noticed that if you had an overnight backup, when you unlock your screen, a copy starts to run. It’s typically quite brief, thanks to ⚡️Turbo Smart Update, but it might surprise you anyway. […] During your overnight copy, SuperDuper kept track of the files that it couldn’t access due to their protection class. And now that it can access them, it’s making sure they get backed up.

This seems like the right thing to do. Time Machine also does it. A backup app should try to make as faithful a backup as possible. I kind of find it annoying, though. Sometimes it can’t do a Turbo Smart Update, and so the backup that should already be done may end up taking another 30 minutes or more. The best thing to do is schedule backups while you’re using your Mac to avoid SuperDuper needing to do such “follow-ups.”

I wrote some code to try to figure out which files I have that are using data protection. Interestingly, the URLFileProtection API seems to not work on macOS. I used the lower level getattrlist() instead. Nanian recommends fcntl(). I didn’t find any protected files that I actually care about, just caches and derived data from Apple’s own apps. But, in theory, Apple or a third-party app could be saving actual user data using data protection.

Previously:

• SuperDuper 4
• Launching Before UserDefaults Is Available
• Apple Addresses iOS Surveillance and Forensics Vulnerabilities

Apple File System (APFS) Backup File Permissions Mac Mac App macOS Tahoe 26 Programming SuperDuper Time Machine