6

I just came across this thread about securely deleting files:

If, by stroke of misfortune, you're on a magnetic medium, have journalling disabled and, for some reason, can't encrypt the disk, you're options are:

* Use rm -P which overwrites files with 0xff, then 0x00, and then 0xff again

And this contradictory superuser thread. Apparently it's not easy to securely delete files using Apple's older HFS+/Journaled file system.

Without the use of third-party software, is it possible to natively wipe a file in macOS Mojave (or High Sierra) that's using APFS and FileVault encryption?

I understand macOS makes it difficult with all of its journaling and backup functionalities. But I'm looking for a shred or srm type of solution that's built into macOS already.

3
  • What kind of drive are you using? - Apple SSD? External old-fashioned hard drive or?
    – jksoegaard
    Sep 3, 2019 at 17:54
  • Don't bet that any of this shredding works. You need to decide how important this data is to you. Don't think people want to see you baby pictures. How much will it cost you if the data gets in the wrong hands. Spend that your dollars that way. Sep 3, 2019 at 22:13
  • HD's, I take the drive apart, and save the magnets, they come off with a wood chisel, then stack up the platters in a pile. A good pair of tin snips will take care of any SSD. Depending on any company's security algorithms seems fraught, when you really want security. Sep 3, 2019 at 23:23

1 Answer 1

4

The answer Apple implies:

You don't have to worry about that, since each file's data is not stored contiguously in the drive, but spread out across several physical and logical blocks. Removing a file from the file table makes it nearly impossible to read with forensic software/hardware.

Sources: About Apple File System | Apple File System Reference

The answer that may or may not work:

brew install coreutils
shred Secrets.txt

The documentation for shred doesn't explicitly call out APFS, but from what it says, it might be the case that the data is not necessarily overwritten.

If you wish to engage in determining this, there are contacts and other related links here: http://www.gnu.org/software/coreutils/

3
  • Wil shred actualkly overwite the same cells in a SSD or just be like any other update to a file and use a new memory cell?
    – mmmmmm
    Sep 3, 2019 at 18:22
  • 1
    @historystamp OP never said several drives are being used, and neither did I. In an SSD, logical blocks aren't necessarily physical blocks; the drive's controller might split them up to reduce wear. It does not depend on the file type; as far as the file system cares, it's all just binary data blobs. The importance of the data is irrelevant to this question.
    – Ky -
    Sep 3, 2019 at 23:50
  • @Mark The full documentation for shred, including exceptions, is here: gnu.org/software/coreutils/manual/html_node/… - They don't explicitly call out APFS, but from what they say, it might be the case that the data is not necessarily overwritten. There are contacts and other related links here: gnu.org/software/coreutils
    – Ky -
    Sep 3, 2019 at 23:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .