Does FileVault 2 encrypt my free disk space as well as the deleted files that may linger on there? I ask this because I am selling my MacBook Pro and want to sell it but I'm not sure how to securely erase my free disk space. So I'm trying to encrypt my drive then reinstall Mac OS X over it (purposely forgetting my encryption key).
Yes, FileVault 2 encrypts the entire drive, including free space and trash.
To securely delete the entire drive, I find this info here:
While Apple removed secure-erase options from the Finder, Terminal commands still exist that can be used. The first is the classic “rm” file removal command, augmented with the “r” flags for recursive deletion of folders, and “P” to implement an overwrite of the removed files:
rm -rP /path/to/file-or-folder
For more thorough secure deletion, you can use the “srm” command (for secure rm) along with similar options to recurse (r), force confirmation (f), and then be verbose to show information about files being removed (v). The second flag (-s) is important for the type of secure erase to perform:
srm -rfv -s /path/to/file-or-folder
In this command, -s will perform a single-pass erase, but you can use -m for a seven-pass erase, or -z for overwriting with zeros. If you do not use this second flag, then the command will perform a 35-pass erase.
Erasing free space on a drive
In some cases, you might want to run an overwrite routine on the free space of a given drive, but unfortunately Apple has also removed options to erase free space in the new version of Disk Utility, which may leave you wondering how to do this. Granted on SSD devices, secure-erase can impact the life span of the drive, but it may still be useful for HDD devices.
To do this in El Capitan, you can again use Terminal commands:
diskutil secureErase freespace LEVEL /Volumes/DRIVENAME
In this command, change LEVEL to a number of 0 through 4, where 0 is a single-pass of zeros, 1 is a single-pass of random numbers, 2 is a 7-pass erase, 3 is a 35-pass erase, and 4 is a 3-pass erase (note all non single-pass options may take a while to complete). Change DRIVENAME to the name of the mounted drive (encase the name in quotes if it contains punctuation or spaces), and then press Enter to run the command.