After reading the other answers and looking into this myself I have observed some file system behavior, which implies a very simple solution. The terminal program stores it's data in
~/Library/Saved Application State/com.apple.Terminal.savedState/
as noted above. When I quit the entire Terminal app (cleanly) this entire folder is deleted. The reason the OP is getting restored data is because he is crashing the terminal app with
killall. I observed this by opening finder to the
Saved Application State folder and starting and quitting terminal. The down side of this is that you have to close ALL terminal windows, but in this way all saved state appears to be wiped clean (baring disk forensics of course)
There appears to be one file in this directory for every open terminal window (but not every tab!) plus data.data and windows.plist and
window_1.data that presumably represents the terminal program itself. The per-terminal files disappear on the closing of the window however the data.data file is the one that grows as commands are issued and thus presumably stores the scrollback buffer. It does not shrink on the closing of the terminal window implying that it continues to hold scrollback data. The
data.data file does however shrink when the next terminal window is opened. It also shrinks drastically when another terminal window is updated (by pressing return for example). Thus it appears that the following routine will (probably) wipe the scrollback data completely:
- Cleanly close the window with the sensitive data (e.g. red dot,
command + w)
- Open a new terminal window OR cause scroll in another terminal window that is already open.
- Close the entire terminal application cleanly (Command + q etc)
It's also worth noting that the
data.data file is not a text file. It is a binary file that will require effort to interpret. My guess is that the data is compressed in some way. A simple
cat of the file reveals nothing legible. So for these files to be a vulnerability, it seems both of the following must be true:
- Terminal has died and
NSQuitAlwaysKeepsWindows is true (see other answer), or the terminal window was closed and no other window has been opened or updated.
- The attacker is sophisticated enough to know enough to look for and know how to decode the data.data file.
PLEASE NOTE: the above is based entirely on observation of how files appear/disappear and how their sizes change. It is of course still possible that some partial information is retained if the maintenance of the
data.data file is sloppy. However these observations seem good enough for me. Decide for yourself if it's good enough for you.
These observations come from OS X 10.9.5 and Terminal Version 2.4 (326), please verify the above described behavior if you are using some other version before relying on this advice. Any or all of this could change with new versions of terminal or Mac OSX.