Check Encrypted HFS+ Drives Before macOS 28

Apple published a quiet support note that is going to matter to anyone with old encrypted Mac drives in a drawer.

Apple says macOS 28 and later will support Mac OS Extended only for volumes that are not encrypted. In plain terms, unencrypted HFS+ volumes keep working. Encrypted HFS+ volumes are the problem. If a drive shows both “Mac OS Extended” and “Encrypted,” Apple says it will not be compatible with macOS 28 or later.

That is a narrow change, but it is exactly the kind of narrow change that can turn into a bad day. The affected drive may not be the one you use every day. It may be an archive drive, a client handoff drive, an old Time Machine disk, a drawer backup, a lab disk, or a spinning external drive that only comes out when something else has already gone wrong.

The time to check those disks is before macOS 28 ships, not after a Mac refuses to mount the only copy of something important.

What is actually changing

Apple is not dropping every HFS+ disk in macOS 28. The support document is more specific than that.

Mac OS Extended, also known as HFS Plus or HFS+, will still be supported when the volume is not encrypted. The unsupported case is encrypted Mac OS Extended. Apple gives an example format string that should make the risk easy to spot:

CoreStorage Logical Volume - Mac OS Extended (Case-sensitive, Journaled, Encrypted)

Starting with macOS 26, Apple says the Mac may warn users when it detects an encrypted Mac OS Extended disk that will not be compatible with macOS 28 or later. That warning helps, but I would not rely on it as the inventory plan. A warning only helps when the drive is connected, unlocked, and noticed by the person who can make the migration decision.

MacRumors and Macworld both framed this as another nudge away from old encrypted HFS+ storage and toward APFS. That is the right practical reading. APFS has been the default Mac file system since macOS High Sierra, and Apple’s Disk Utility documentation describes APFS as the default format for macOS 10.13 or later with strong encryption, snapshots, space sharing, and improved file-system fundamentals.

Why this catches people

The risky drives are not always obvious.

When APFS arrived, a lot of people still had older external hard drives formatted as Mac OS Extended. That was normal. HFS+ had years of compatibility behind it, and for traditional hard drives it remained a familiar choice. If someone added encryption years ago, especially before APFS became the normal answer, they may still have encrypted HFS+ volumes in service.

Those volumes may be healthy today. They may mount perfectly on macOS 26 or macOS 27. That does not make them future-proof.

The problem is not that the data is bad. The problem is that the encryption layer around that HFS+ volume is becoming the incompatible part. If the disk is an archive, the owner may discover the issue only when they need the archive. That is the worst time to start deciding whether the data exists somewhere else.

How to check a drive

Apple’s check path is simple and worth doing manually.

Connect the drive.
Unlock it if macOS asks for the encryption password.
Open Disk Utility.
From View, choose Show Only Volumes.
Select the volume name in the sidebar.
Look directly under the volume name for the format details.

If the details include both Mac OS Extended and Encrypted, the volume is affected.

I would also capture a command-line inventory for any drive I care about:

diskutil list
diskutil info /Volumes/VolumeName
diskutil cs list

diskutil info is useful because it gives a fuller picture of the volume, file system personality, encryption state, and device relationship. diskutil cs list matters for older Core Storage-backed encrypted HFS+ volumes, and Apple specifically mentions it as a way to check decryption progress.

For a small business or managed Mac environment, I would turn this into a storage review task:

Find external drives used for backup, archive, field work, or client data.
Identify which are APFS, APFS Encrypted, HFS+, or encrypted HFS+.
Confirm whether the data exists in more than one place.
Decide whether the drive should be migrated, retired, or left unencrypted for compatibility.
Label the drive after migration so the next person does not have to rediscover the format.

The two safe paths

Apple gives two paths: reformat or decrypt.

Reformatting is the clean path when the data already exists somewhere else. Back up the data, erase the volume in Disk Utility, and choose APFS or APFS (Encrypted). This permanently deletes the current contents, so the backup has to be real before the erase happens.

For long-term Mac-only encrypted storage, APFS (Encrypted) is the direction I would choose. Apple’s Disk Utility guide lists APFS (Encrypted) as an APFS format option and describes APFS as supporting encryption, space sharing, snapshots, and modern file-system behavior. If the drive needs to move between Mac and Windows systems, APFS may not be the right interoperability choice, but encrypted HFS+ is still not the future-proof answer for macOS 28.

Decrypting is the path when preserving the existing volume is more important. Apple’s instructions are to connect the drive, unlock it, Control-click the drive in Finder or on the desktop, choose Decrypt, enter the password, and wait. Large volumes can take a long time. After decryption, Apple says the volume can optionally be converted to APFS in Disk Utility without erasing, and then encrypted again as APFS.

There is one important exception in Apple’s note: the decrypt path does not apply to encrypted Time Machine backup disks. I would treat old encrypted Time Machine disks as a separate migration decision. In many cases the cleaner answer is to start a new backup on APFS-formatted storage, keep the old disk offline only until retention needs are satisfied, and make sure the current backup strategy is actually working.

How I would migrate an archive drive

For an archive drive, I would not start by clicking Convert.

I would start by proving the data exists somewhere else:

rsync -avh --progress /Volumes/OldArchive/ /Volumes/NewArchiveBackup/

Then I would sample the backup:

find /Volumes/OldArchive -type f | wc -l
find /Volumes/NewArchiveBackup -type f | wc -l
du -sh /Volumes/OldArchive /Volumes/NewArchiveBackup

Those checks are not a forensic verification, but they catch obvious mistakes before touching the original volume. For higher-value archives, I would use checksums or a backup tool with verification.

After that, I would decide whether the existing drive deserves to keep working. If it is old, slow, noisy, or used only because it happened to be available, I would migrate to a new APFS Encrypted drive and retire the old disk. If the hardware is still good and the data is already backed up, I would erase and reformat it as APFS (Encrypted) rather than carrying forward years of old volume history.

The key is to make the drive boring before macOS 28. A boring archive drive mounts, decrypts, and reads on a current Mac without needing an old OS workaround.

What not to assume

Do not assume every encrypted external drive is affected. APFS (Encrypted) is not the same as encrypted Mac OS Extended.

Do not assume every HFS+ drive is affected. Apple says unencrypted Mac OS Extended volumes continue to be supported.

Do not assume the notification will find every drive that matters. A drive in a drawer cannot warn you.

Do not assume an archive is safe because it mounted once last year. Mount it now, check the format, and decide what it should become.

The practical takeaway

This is not a panic story. It is a cleanup story with a deadline.

Apple is telling us that encrypted HFS+ is on the way out in macOS 28. The affected storage is specific: Mac OS Extended plus encryption. The fix is also specific: back up, then decrypt or reformat, with APFS (Encrypted) being the better long-term Mac-native format for encrypted external storage.

The right move is to check old drives now. Plug them in, identify the format, make a backup, and migrate anything that still matters. The worst time to learn about this change is when the only Mac available is already running macOS 28 and the old encrypted archive no longer mounts.