2

Does FileVault 2 encrypt my free disk space as well as the deleted files that may linger on there? I ask this because I am selling my MacBook Pro and want to sell it but I'm not sure how to securely erase my free disk space. So I'm trying to encrypt my drive then reinstall Mac OS X over it (purposely forgetting my encryption key).

  • Why not just boot into Recovery HD and do a 7x erase or whatever on your HD and then reinstall OS X. – At0mic May 4 '16 at 21:24
3

Yes, FileVault 2 encrypts the entire drive, including free space and trash.

To securely delete the entire drive, I find this info here:

While Apple removed secure-erase options from the Finder, Terminal commands still exist that can be used. The first is the classic “rm” file removal command, augmented with the “r” flags for recursive deletion of folders, and “P” to implement an overwrite of the removed files:

rm -rP /path/to/file-or-folder

For more thorough secure deletion, you can use the “srm” command (for secure rm) along with similar options to recurse (r), force confirmation (f), and then be verbose to show information about files being removed (v). The second flag (-s) is important for the type of secure erase to perform:

srm -rfv -s /path/to/file-or-folder

In this command, -s will perform a single-pass erase, but you can use -m for a seven-pass erase, or -z for overwriting with zeros. If you do not use this second flag, then the command will perform a 35-pass erase.

Erasing free space on a drive

In some cases, you might want to run an overwrite routine on the free space of a given drive, but unfortunately Apple has also removed options to erase free space in the new version of Disk Utility, which may leave you wondering how to do this. Granted on SSD devices, secure-erase can impact the life span of the drive, but it may still be useful for HDD devices.

To do this in El Capitan, you can again use Terminal commands:

diskutil secureErase freespace LEVEL /Volumes/DRIVENAME

In this command, change LEVEL to a number of 0 through 4, where 0 is a single-pass of zeros, 1 is a single-pass of random numbers, 2 is a 7-pass erase, 3 is a 35-pass erase, and 4 is a 3-pass erase (note all non single-pass options may take a while to complete). Change DRIVENAME to the name of the mounted drive (encase the name in quotes if it contains punctuation or spaces), and then press Enter to run the command.

  • This is not true. FileVault neither encrypts free volume (or only small chunks) nor free disk space! – klanomath May 4 '16 at 22:37
  • klanomath, FileVault doesn't encrypt free disk space in, let's say, my main Mac OS X partition? – Lucky May 5 '16 at 1:03
  • I was going by this Apple page: "With FileVault 2, your data is safe and secure — even if your Mac falls into the wrong hands. FileVault 2 encrypts the entire drive on your Mac, protecting your data with XTS-AES 128 encryption. Initial encryption is fast and unobtrusive. It can also encrypt any removable drive, helping you secure Time Machine backups or other external drives with ease. Instant wipe removes the encryption keys from your Mac — making the data completely inaccessible." – fsb May 5 '16 at 1:50
  • There are two "types" of free disk space and it's unclear from this answer or the linked articles if FileVault 2 encrypts both types. I have not been able to find the answer. Type 1) space that was free before FileVault 2 was enabled. This includes unencrypted deleted files. Type 2) space that was freed after FileVault 2 is enabled. This includes files deleted after they were encrypted... so the encrypted deleted files remain, but are secure because they are encrypted. So the question is: what happens to existing free space when FileVault 2 is enabled? Is the existing free space encrypted? – Jason Mar 8 '18 at 15:26
  • To clarify one point... when Apple says "full disk" they may be saying this in contrast to the original FileVault, which encrypted a user's home directory. So "full disk" may mean "all files on the startup partition" and not "every byte, free or used, on the disk". If there's any question about this, consider that some bytes must be unencrypted at startup and boot the initial login screen that prompts for a password. So in fact, Apple really doesn't mean that every byte on the disk is encrypted. – Jason Mar 8 '18 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .