I know that one can encrypt a whole disk using File Vault when the disk is first used and loaded with user data.

Wondering whether encrypting at time of disk disposal would be equality effective?

  • 1
    I would say it is not, since presumably File Vault goes through and encrypts any data that is part of the file system. However, unused space is unlikely to be encrypted. That space could have previously contained sensitive files.
    – Ezekiel
    Apr 26 '21 at 21:59
  • What kind of Mac do you use, with which version of macOS?
    – nohillside
    Apr 26 '21 at 22:00

No, it won't be as effective. Encrypting before writing anything (/anything important) is the best (most secure) option, but if you miss the opportunity to do that there are still methods better than retroactive encryption.

(Note: this is mostly inapplicable to the built-in SSD in newer Macs with the T2 chip or "Apple Silicon" CPUs, since they automatically encrypt the data volume, with an encryption key protected by the Secure Enclave. Turning on FileVault on these models doesn't encrypt the volume, since it already is encrypted -- it encrypts the encryption key. However, any data stored on other volumes or other SSDs is not protected by this, so the following discussion does apply.)

When you retroactively encrypt a drive, what you're basically doing is overwriting the old (unencrypted) data with an encrypted version. Overwriting the whole disk with zeros or random data is better for several reasons:

  • Encrypted data might be decryptable if the key/password leaks, is guessable, accidentally gets stored somewhere else, etc. Zeroes and random data cannot be decrypted because they don't contain any (relevant) information. Encrypting sounds like it's providing some extra level of protection, but this is illusory.
  • Depending on how the encrypt procedure works, it might not bother to encrypt "unused" portions of the disk -- but they might still contain leftover copies of old files (Ezekiel Elin mentioned this in a comment). I don't know exactly how macOS' current implementation works, but I know that overwriting the whole drive with zeroes/random data doesn't have this problem (well... with a caveat I'll get to).
  • macOS' volume encryption works at the volume level, and doesn't encrypt parts of the disk outside of your data volume. And there are a few types of info that may be stored outside of that.

There's also a problem that even overwriting with zeroes or random data doesn't solve: the SSD itself doesn't expose all of its storage space to the computer, so if you erase/overwrite "everything" from the computer... you haven't actually erased/overwritten everything. Reading the hidden residual data generally involves disassembling the SSD and bypassing its controller to read from the raw chips, so it's not something people are likely to do unless they think there's something of serious value on your SSD, so you probably don't have to worry about this. See my answer here and the links in it for the gory technical details. Long story short, overwriting the entire exposed space twice is generally -- but not necessarily -- enough to overwrite all the actual data.

So, in summary: if there's something of really high value on the drive, either don't ever write it unencrypted in the first place, or physically destroy the drive before disposing of it. For reasonable-level sensitive data (e.g. your banking info), overwrite twice with zeroes and/or random data before selling/donating/whatever.

  • 1
    Does this apply to T2 and M1 Macs?
    – Gilby
    Apr 27 '21 at 3:45
  • @Gilby Good question! It's mostly irrelevant to them, since they auto-encrypt the data volume before you have a chance to put anything on it. I added a note about this. Apr 27 '21 at 4:22
  • @GordonDavisson You succeeded in your contribution. How often do you recommend overwriting? Apr 27 '21 at 6:10
  • 1
    @DarwinOSX Overwriting isn't something you should do regularly, since SSDs have a limited write lifetime. Two overwrites before disposing should be fine. Or if you're going to switch from unencrypted to encrypted, overwrite all "empty" space twice (with an HFS+ volume, diskutil secureErase freespace 1 /dev/whatever will do a single pass; I don't know of a way to do it with APFS). Apr 27 '21 at 7:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .