@thor @theopolis I’ve updated the APFS encryption issue with my findings. https://github.com/facebook/osquery/issues/3709#issuecomment-331538977