Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

When I give up my laptop I like to securely delete the hard drive. I would assume that since it's full disk encrypted using file vault that I should be able to just delete the real key for boot partition and be done. No need to write 0s over the filesystem.

Is this true, or do I need to do something extra to make sure that I can safely part with my hard drive?

share|improve this question
add comment

2 Answers

How safe do you want to be? How hard to guess is your File Vault 2 password?

The safest way to ensure your data cannot be recovered is to destroy the drive. Zeroing out an encrypted drive multiple times provides a level of protection less than destroying the drive but more than simply relying on the encryption. For most ordinary data, File Vault 2 whole-disk encryption should be a reasonable level of protection.

If your drive contains national secrets that will result in people dying should they fall into the wrong hands, or the secret recipe for a billion-dollar trade secret, do more. If someone is trying to steal a social security number or credit card number that might be saved on your drive, there are far easier ways than trying to brute force their way into your encrypted drive.

share|improve this answer
1  
That a drive must be overwritten multiple times is a common misconception that was shown to be wrong. –  Daniel Beck Jan 24 '12 at 7:21
    
I suggest to add another risk analysis question thread after your 1st one: Where is stored your FileVault password? Where is it backed up? Is a master password defined for your Mac? –  daniel Azuelos May 17 '12 at 8:56
add comment

No - the point of FileVault 2 is to make it extremely difficult for a motivated person to decipher what was stored on that volume.

I would pay more attention to destroying that key that was used encrypt the data than the drive.

Of course, you could zero the drive, but why not go one better and pick a new encryption key that was never used, and never will be used and let your machine re-do the encryption of the drive once you have erased all the data one pass.

Since there have been no scholarly articles on how easy it is to decrypt a FileVault drive nor reports of exploits - you have to weigh the potential damage that leak of information could be. FileVault makes it much easier to not worry if you lose a drive, so the old saw to be sure to overwrite things many times is far less applicable for drives where encryption exists at rest.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.