> (the OS volume itself isn't encrypted and is read-only, the data volume is encrypted with your password) Wait, WHAT? Can someone with an M1 encrypted volume

> (the OS volume itself isn't encrypted and is read-only, the data volume is encrypted with your password) Wait, WHAT? Can someone with an M1 encrypted volume Mac check this directory and see if you see thumbnails? > $TMPDIR/../C/com.apple.QuickLook.thumbnailcache/ A full writeup of this is at the link [1]. This has been a well-known thing in computer forensics for many years, which is why *full* disk encryption is so important. [1]: https://objective-see.com/blog/blog_0x30.html https://objective-see.com/blog/blog_0x30.html