3

I had some problems with an old user account on a Macbook Pro with SSD, and I wanted to start fresh. I am not sure if I deleted the account, but I think I did reinstall the OS through I think internet recovery mode. The old account is not present in Users & Groups.

I did

My-MacBook-Pro-2:Desktop accoutname$ sudo diskutil secureErase 
freespace 0 /Volumes/Macintosh\ HD

and the following is the response I got from Terminal:

Started erase on disk1 Macintosh HD
Creating a temporary file
Securely erasing a file
Creating a secondary temporary file
Mounting disk
Finished erase on disk1 Macintosh HD

In Disk Utility there are two Macintosh HD's shown, the top one with '0 Bytes Available' and the bottom indented one with 180 GB available. Did both of these HD's with the same name get erased by my Terminal command?

FileVault is enabled on the current account but not sure if it was on the old account. Either way I know FileVault isn't totally foolproof (https://www.blackbagtech.com/blog/2017/07/13/macquisition-best-just-got-better/), and since I'm not 100% sure how the old account was deleted, I just wanted to ask if my current method through Terminal makes the data on the old account non recoverable? Any other steps I should take?

3
  • The macquisition link implies it needs the password or key to get at FileVault 2. I'm not sure you wouldn't be safe just cycling the file vault keys. Are you looking to protect an unlocked / compromised FV2 mac?
    – bmike
    Jul 31, 2017 at 22:52
  • Per-user FileVault hasn't been a thing for a while now so hopefully you're using FileVault 2 with full disk encryption (FDE). I suspect Disk Utility didn't refresh properly, check "diskutil list" output to be sure. bmike is correct, secureErase doesn't work with SSDs. If you weren't using some sort of encryption for that data before it was written to an SSD then I'd assume it could be recovered.
    – MacManager
    Aug 4, 2017 at 17:54
  • 'If you weren't using some sort of encryption for that data before it was written to an SSD then I'd assume it could be recovered.' Wouldn't enabling File Vault 2 after the data was written to the SSD still encrypt the data, because it encrypts the whole drive? And therefore when the drive is erased, the data can't be recovered?
    – user249662
    Aug 16, 2017 at 9:06

1 Answer 1

2

Everything you describe seems to be just fine. To be totally sure I would re-enable FileVault and then cycle the keys (boot to recovery HD and erase the FV volume.) That ensures that each "block" is cryptographically scrubbed before you then re-introduce a new OS and then turn on FileVault2.

The main lesson to keep in mind is with SSD - be sure to enable FileVault before you put anything secure on the drive. That way when SSD swaps in new "excess capacity" blocks to replace others - you don't get old plain text data restored or have plain text data taken "offline" only to be possibly be put into service after you do the "wipe".

https://support.apple.com/kb/PH22241

The key phrase is:

Note: With a solid-state drive (SSD), secure erase options are not available in Disk Utility. For more security, consider turning on FileVault encryption when you start using your SSD drive.

6
  • 1
    If FileVault 2 is enabled then you can just change the recovery key using the fdesetup command. Don't need to erase the disk.
    – MacManager
    Aug 4, 2017 at 17:56
  • So I guess the only potential problem is that I didn't enable File Vault 2 when I first put the sensitive data on in the first place. Since then, however, I have enabled File Vault 2, used Terminal to Secure Erase Free Space, booted in Internet Recovery Mode, erased both Macintosh HD's, reinstalled the OS, and enabled File Vault 2 on the new OS. Could that still not be sufficient, due to the fact that File Vault 2 was not enabled before the data went on the drive? If so, would it be worth to use something like Parted Magic (partedmagic.com)?
    – user249662
    Aug 8, 2017 at 20:41
  • @itstoocold The longer you use the drive with FileVault on, the more likely you overwrite and encrypt the potential data leakage. I don’t think any tool other than an oem wipe would matter at this point. Probably easier to just fill the drive with YouTube videos than worry about free space reclamation and excess capacity.
    – bmike
    Aug 8, 2017 at 23:52
  • Do you mind me asking what an OEM wipe is? I couldn't find any information about it on the internet. I could fill the drive with Youtube videos, but since I plan to still use the computer, I thought the secure erase of free space triggered through Terminal, along with the erasing both Macintosh HD's in Internet Recovery mode, would suffice instead. Please correct me if I'm wrong. Finally, would doing a secure erase through a software such as Parted Magic help? How about an encryption alternative to File Vault 2, because it's not very hard to reset/find out ...
    – user249662
    Aug 16, 2017 at 9:21
  • ... someone's login password (cnet.com/how-to/reset-bypass-password-mac-macbook). And last thing, you don't see a problem with Disk Utility showing two Macintosh HD's, the outer HD with 0 bytes available and the inner HD with a normal amount of bytes available? Thanks for the help.
    – user249662
    Aug 16, 2017 at 9:21

You must log in to answer this question.