I know that one can encrypt a whole disk using File Vault when the disk is first used and loaded with user data.
Wondering whether encrypting at time of disk disposal would be equality effective?
Ask Different is a question and answer site for power users of Apple hardware and software. It only takes a minute to sign up.
Sign up to join this communityI know that one can encrypt a whole disk using File Vault when the disk is first used and loaded with user data.
Wondering whether encrypting at time of disk disposal would be equality effective?
No, it won't be as effective. Encrypting before writing anything (/anything important) is the best (most secure) option, but if you miss the opportunity to do that there are still methods better than retroactive encryption.
(Note: this is mostly inapplicable to the built-in SSD in newer Macs with the T2 chip or "Apple Silicon" CPUs, since they automatically encrypt the data volume, with an encryption key protected by the Secure Enclave. Turning on FileVault on these models doesn't encrypt the volume, since it already is encrypted -- it encrypts the encryption key. However, any data stored on other volumes or other SSDs is not protected by this, so the following discussion does apply.)
When you retroactively encrypt a drive, what you're basically doing is overwriting the old (unencrypted) data with an encrypted version. Overwriting the whole disk with zeros or random data is better for several reasons:
There's also a problem that even overwriting with zeroes or random data doesn't solve: the SSD itself doesn't expose all of its storage space to the computer, so if you erase/overwrite "everything" from the computer... you haven't actually erased/overwritten everything. Reading the hidden residual data generally involves disassembling the SSD and bypassing its controller to read from the raw chips, so it's not something people are likely to do unless they think there's something of serious value on your SSD, so you probably don't have to worry about this. See my answer here and the links in it for the gory technical details. Long story short, overwriting the entire exposed space twice is generally -- but not necessarily -- enough to overwrite all the actual data.
So, in summary: if there's something of really high value on the drive, either don't ever write it unencrypted in the first place, or physically destroy the drive before disposing of it. For reasonable-level sensitive data (e.g. your banking info), overwrite twice with zeroes and/or random data before selling/donating/whatever.
diskutil secureErase freespace 1 /dev/whatever
will do a single pass; I don't know of a way to do it with APFS).
Apr 27, 2021 at 7:02