3

I am trying to sell my MacBook Pro 2011 and want to erase the SSD for good. It’s running High Sierra. Despite what Apple says, I read it’s better to have FileVault turned on and then erase the machine.

Unfortunately, before I realised I should have done this, I had already erased the machine without FileVault on at all. After reading these articles I then turned on FileVault, (effectively had a blank macOS without any files) which generated a key, then I erased it again. However, when I went to erase it the second time via Internet Recovery Mode (I don’t want to re add my iCloud password to reinstall macOS), it certainly said the drive was AFPS (encrypted) where the word encryption was new to me, however it didn’t ask me to “unlock” the SSD at all. I was just able to click erase and it just said something like “are you sure you want to do this?” And as per usual I formatted it back into the usual AFPS format. The now new macOS has FileVault turned off again.

Now I’m concerned that the FileVault didn’t even work given I was able to erase and format the SSD without a passcode or key despite FileVault being on. Shouldn’t it stop me from doing these sorts of things by asking for a key? Note I never used FileVault before this and erased it once without having FileVault, so did I stuff up the process?

Thanks.

4
  • Encrypting the volume with FileVault doesn't do a very effective job at removing previous data from the disk -- it's designed to protect the data you store in the encrypted volume after it's encrypted, not to protect what was stored there before you encrypted it. Commented Feb 22, 2022 at 8:31
  • @GordonDavisson I see, does it do anything at all to the files stored on the disk prior to turning on FileVault? What happened if you turned it off and on again?
    – Elle
    Commented Feb 22, 2022 at 9:37
  • Unfortunately, I haven't experimented with the new filesystem (APFS) enough to know exactly what it does; sorry. Commented Feb 22, 2022 at 9:46
  • 1
    FileVault is meant to prevent other people from reading the data on your drive. Erasing the drive also prevents other people from reading the data on the drive, password or no.
    – Vikki
    Commented Feb 22, 2022 at 19:18

1 Answer 1

6

The process worked as designed - you didn’t cause any issues with the double formatting.

FileVault is software designed to protect the data on your disk from being read by others that do not have the decryption password. However, FileVault does not protect the disk from being erased, even without the password, as you have seen.

4
  • 1
    Thank you. Just so I can learn, at what point would I be asked to provide the decryption password once Firevault is on? I never forget my laptop's administration password, but one time I did trial out FindMyMac and set my laptops to 'lost'. The new one required iCloud login and the old one just required a new PIN that I had set from my phone. Apart from that instance though, I've never had to enter in a decryption code.
    – Elle
    Commented Feb 22, 2022 at 9:39
  • Sure! Hope this helps. You would be asked for the FileVault password (which is also your account login password) when logging in to your account on the Mac.
    – Scot
    Commented Feb 22, 2022 at 16:17
  • FindMyMac is another, separate system that can lock/wipe your machine if you mark it as lost, but it is somewhat of a distinct system from FileVault, which encrypts the data.
    – Scot
    Commented Feb 22, 2022 at 16:18
  • 1
    So, if someone’s Mac (with FindMyMac on, FileVault off) was stolen, then the owner could attempt to find it and try to wipe it. But in addition, the data on the Mac is unencrypted, and potentially readable to anyone. If FileVault was -also- on in this case, the data would be unreadable to anyone that does not have the password.
    – Scot
    Commented Feb 22, 2022 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .