3

I just came across this thread about securely deleting files:

If, by stroke of misfortune, you're on a magnetic medium, have journalling disabled and, for some reason, can't encrypt the disk, you're options are:

* Use rm -P which overwrites files with 0xff, then 0x00, and then 0xff again

And this contradictory superuser thread. Apparently it's not easy to securely delete files using Apple's older HFS+/Journaled file system.

Without the use of third-party software, is it possible to natively wipe a file in macOS Mojave (or High Sierra) that's using APFS and FileVault encryption?

I understand macOS makes it difficult with all of its journaling and backup functionalities. But I'm looking for a shred or srm type of solution that's built into macOS already.

  • What kind of drive are you using? - Apple SSD? External old-fashioned hard drive or? – jksoegaard Sep 3 at 17:54
  • Don't bet that any of this shredding works. You need to decide how important this data is to you. Don't think people want to see you baby pictures. How much will it cost you if the data gets in the wrong hands. Spend that your dollars that way. – historystamp Sep 3 at 22:13
  • HD's, I take the drive apart, and save the magnets, they come off with a wood chisel, then stack up the platters in a pile. A good pair of tin snips will take care of any SSD. Depending on any company's security algorithms seems fraught, when you really want security. – Wayfaring Stranger Sep 3 at 23:23
1

The answer Apple implies:

You don't have to worry about that, since each file's data is not stored contiguously in the drive, but spread out across several physical and logical blocks. Removing a file from the file table makes it nearly impossible to read with forensic software/hardware.

Sources: About Apple File System | Apple File System Reference

The answer that may or may not work:

brew install coreutils
shred Secrets.txt

The documentation for shred doesn't explicitly call out APFS, but from what it says, it might be the case that the data is not necessarily overwritten.

If you wish to engage in determining this, there are contacts and other related links here: http://www.gnu.org/software/coreutils/

  • Wil shred actualkly overwite the same cells in a SSD or just be like any other update to a file and use a new memory cell? – user151019 Sep 3 at 18:22
  • 1
    @historystamp OP never said several drives are being used, and neither did I. In an SSD, logical blocks aren't necessarily physical blocks; the drive's controller might split them up to reduce wear. It does not depend on the file type; as far as the file system cares, it's all just binary data blobs. The importance of the data is irrelevant to this question. – Ben Leggiero Sep 3 at 23:50
  • @Mark The full documentation for shred, including exceptions, is here: gnu.org/software/coreutils/manual/html_node/… - They don't explicitly call out APFS, but from what they say, it might be the case that the data is not necessarily overwritten. There are contacts and other related links here: gnu.org/software/coreutils – Ben Leggiero Sep 3 at 23:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .