1

Since all MacBooks with Apple-SSDs have TRIM enabled, I was wondering if trimming would “reset/prepare” the blocks for new writes, or would they leave the blocks there until a new write comes in.

If blocks are reset/prepared in advance of new writes, would forensic recoverability of data still be possible?

1

MacOS issues the TRIM command to the disk drive controller. From that point on the operating system have no control over the process. What happens is entirely drive dependent.

The most common is that the blocks are marked as unused in a bitmap in the drive, but the contents are otherwise left alone. In order to prevent the possibility of forensics, you’ll need to send a secure erase command instead.

Depending on the drive, that will typically either erase the blocks or throw away an encryption key - or possibly both (typically on Intel drives). The end result is making it impossible to retrieve the data that was previously stored in those blocks.

  • In the second paragraph, you state that it is most common that the contents are left alone. However, in the third paragraph, you say that typically in intel drives, blocks are erased or the (file) encryption key is thrown. – NoMoreErrors Jul 7 '18 at 11:14
  • MacBooks are intel based (i5/i7 core) with an Apple SSD controller and Samsung-manufactured SSD. Does the third paragraph apply? – NoMoreErrors Jul 7 '18 at 11:15
  • Also, by erased, do you mean that the SSD specifically erases that block containing the file (bypassing wear levelling)? If the encryption key is thrown (deleted), is it possible to match the key to the file it decrypts? – NoMoreErrors Jul 7 '18 at 11:16
  • I’m with the answer here. There’s no evidence I’ve seen that macOS has any jurisdiction or care what the storage does with low level data once a trim command is issued. There’s no reason each specific vendor and possibly each specific firmware for a given device might not implement this differently. – bmike Jul 7 '18 at 18:23
  • @NoMoreErrors Regarding your first comment: You need to read my answer again. The second paragraph about blocks being left alone are when the trim command is used. The third paragraph concerns the scenario where you use the secure erase commands. – jksoegaard Jul 7 '18 at 19:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .