Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Force Spotlight to properly index a FileVault folder System
With FileVault turned on and logged in as that user, Spotlight would not find all file matches in my search. I have two computers that hold sensitive medical information, so FileVault is a necessity if I want to use Macs.

Symptom: Files located in the Documents folder, or any other standard folder that should be getting indexed by Spotlight, are not found in a typical search. It doesn't seem to matter if you search for exact file names or for text inside the documents. I found the error with Word files, but upon further research, it also affected PDFs and GIF files, and probably others.

It seems to occur for files that were created prior to activating FileVault. Modifying files in some way will fix that particular file and allow Spotlight to index and find it. However, doing that to all your files may not make sense. In this case, you should reindex just your FileVault Home folder. Do not reindex the entire drive because this will not fix the error.

I reindexed my FileVault home folder by dragging the Home folder icon into the Privacy box of the Privacy tab of the Spotlight System Preferences panel. Once it shows up in the Privacy box, select it and hit the minus button to remove it. This will trigger the reindexing; once it finishes, Spotlight should have indexed all your files properly and return proper search results. This was tested on a Tiger and Leopard system suffering from the same error and it worked in both cases.

[robg adds: I don't use FileVault, but would be interested in knowing if others have seen this issue as well -- please comment.]
    •    
  • Currently 2.57 / 5
  You rated: 3 / 5 (7 votes cast)
 
[12,658 views]  

Force Spotlight to properly index a FileVault folder | 5 comments | Create New Account
Click here to return to the 'Force Spotlight to properly index a FileVault folder' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Spotlight can be a window into the contents of Files encrypted in FileVault
Authored by: avendasora on Nov 27, '07 10:06:04AM
I don't believe that Spotlight keeps your FileVault data encrypted in its index and you are dependent upon the Spotlight Plugin for a given document type to determine what information is stored in the Spotlight index. For example, if Microsoft Word's or Adobe Acrobat's plugins pull in the entire text of a document in for indexing, all that text is in the index. Unencrypted.

See: http://developer.apple.com/documentation/Carbon/Conceptual/MetadataIntro/Concepts/SecurityAndPrivacy.html#//apple_ref/doc/uid/TP40001852-CJBEJBHH

The normal Spotlight interface won't show you results that you don't have permissions to view, but if someone can bypass the Spotlight interface and dig directly into the index... yikes. It makes no point to protect all of your sensitive information with FileVault if the same information is stored in the Spotlight index unencrypted.

The Spotlight index is a shared store that contains all the indexed results from the entire drive, for all users and sits at the root of an indexed drive. For this reason I use encrypted DMGs to store sensitive documents instead of FileVault. The index is encrypted along with the other contents of the image. Only when it is mounted is the index available.

Extra paranoia points for storing your encrypted DMGs in your FileVault home folder. :)



[ Reply to This | # ]
Force Spotlight to properly index a FileVault folder
Authored by: noworryz on Nov 27, '07 10:36:15AM

Both the hint and the comment above contain incorrect information about what is actually happening.

File Vault stores the user's home directory as a hidden encrypted disk image (.sparseimage in pre-Leopard .sparsebundle in Leopard). This file or bundle is located in the /Users directory with a period as the first character of its name to keep it hidden.

When the user logs in, the image is mounted, not in the usual /Volumes location, but in /Users. It is a separate "disk," so that is why indexing your main disk has no effect. You can force an index of your home directory "disk" by making it private and then not private from the Spotlight preferences pane.

Contrary to the comment, the index is encrypted. It is stored in the hidden .Spotlight-V100 directory in the users home directory; i.e., on the encrypted disk image that is mounted when the user logs in. There is another .Spotlight-V100 on the main disk, which contains its index, but not indexes of the user's private files.




[ Reply to This | # ]
Force Spotlight to properly index a FileVault folder
Authored by: avendasora on Nov 27, '07 11:17:22AM

Nice. I don't mind being wrong at all!



[ Reply to This | # ]
Force Spotlight to properly index a FileVault folder
Authored by: Typhoon14 on Mar 12, '08 04:42:10PM

I personally had to use Spotless to delete the index directory in order to get my filevault properly indexed. The privacy tab tip supposedly reindexed everything, but left me with the same gaps in my index.



[ Reply to This | # ]
Force Spotlight to properly index a FileVault folder
Authored by: bebosoft on May 12, '09 10:52:42AM

I was experiencing this problem. Any new file was easy to find, but old file were not.

The reply by 'noworryz' is excelent. It solved my problem and the mistery I've been dealing for 2 weeks now.



[ Reply to This | # ]