2

I have a bunch of apple hardware at work that is to be destroyed, because the security guys claim it can't be wiped to NIST PURGE compliance.

All the PC hardware can achieve this level, and we have a specific piece of licenced software authorised to do this, and provide reports. The cleared PC kit gets donated onward to local charities, minimising waste and all that good stuff.

If the macs get destroyed instead of reused, then there's no way for those users to experience a mac environment, and they get stuck with windows or maybe a linux distro.

To be clear - the minimum requirement is "NIST Purge" compliance. I've managed to boot the authorised software on minis and achieved "NIST Clear" levels, which is insufficient.

There's a halfway house of removing the M2 cards from mac minis and onward-donating the remains, but that's sub-optimal. And for many of the MBP and Air laptops, they are "un- upgradeable" suggesting the storage is soldered to the mainboard leaving destruction as the only option.

What can I do to achieve PURGE status on mac hardware?

Specifically for me, the hardware is

  • a1347, 2014 mac mini (about 30 of these)
  • a1502, 2014 13" MBP
  • a1398, 2015 MBP retina
  • a1286, 2011 unibody 15" MBP
  • a1707, 2017 MBP
  • a1418, 2017 imac 21"

Although ideally this question should have generic answers.

Improve this question
8
  • Please don't suggest "photoshop the results" I do want to keep my job, such as it is.
    – Criggie
    Commented Mar 9, 2022 at 22:57
  • Related, but doesn't provide anything useful security.stackexchange.com/questions/37662/…
    – Criggie
    Commented Mar 9, 2022 at 23:02
  • 1
    From BitRaser FAQ: "BitRaser Drive Eraser specializes in securely erasing Apple Mac machines of all models. Our software is an OS independent and works seamlessly across any OS platforms. We also have a dedicated version for wiping Mac T2 devices." Or is that only Clear? (You did mean T2, not M2 didn't you?)
    – Gilby
    Commented Mar 9, 2022 at 23:23
  • 1
    If these are T2 or newer Macs, then you can perform a Cryptographic Erase by using the system provided erase option in Recovery Mode. support.apple.com/guide/security/… The NIST standards for PURGE leave evaluation of the vendor-provided erase function to you. nvlpubs.nist.gov/nistpubs/SpecialPublications/…
    – Ezekiel
    Commented Mar 9, 2022 at 23:31
  • 1
    For non-T2 machines, which many of these are, you can't rely on the Cryptographic Erase unless you've already had Filevault enabled - I believe. However, you may be able to issue an ATA command directly to the disk, but I'm not sure
    – Ezekiel
    Commented Mar 10, 2022 at 16:41

1 Answer 1

Reset to default
1

For Closure

Where the hosts had a removable disk, this was removed. The remains are cleared for "donation" but given the cost of those weird Apple SSD drives, noone wants them.
If the device had a SATA disk, they've all been taken by various charities and re-used with generic PC drives instead and a fresh install of Monterey or Linux.

The hosts with non-removable drives have all been e-wasted at great expense.

The only positive takeaway, is that all mac hardware from now-on is T2 equipped or newer, BUT the company still doesn't have an approved method/process for wiping them.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .