On iPhones and recent Macs with the T2 Secure Enclave, Apple has made sure that cryptographic keys are properly deleted, using effaceable storage. iPhones and T2 machines are encrypted by default. Simply reformatting an iPhone (Erase All Content and Settings) or erasing a drive from Recovery should suffice. Deleting the keys effectively renders the material on a drive inaccessible, even if FileVault has not been enabled or it has and the password isn’t sufficiently secure.
Older machines can be grouped into three categories:
Macs with Apple solid-state drives
Because of wear leveling some areas of the drive are not directly accessible. This means you cannot know for sure whether all areas of the drive have been wiped with a traditional wipe. A quick reformat might start garbage collection on unused areas, but without knowing exactly how your drive’s controller works, it’s difficult to be sure. Most SSDs from Apple are manufactured by Samsung, Toshiba or SanDisk. A good compromise would be wiping free space with random values. It won’t securely erase the entire drive, but it’s as close as you can get and be sure that the SSD controller has overwritten a large percentage of the drive.
Start the macOS installer from an external drive (wiping will be much faster than using target disk mode).
- First, format the drive as HFS+ with a MBR bootblock (takes less space than GUID, resulting in more wiped data) with Disk Utility.
- Start Terminal and run diskutil list to find the volume, then:
diskutil secureErase freespace 1 /dev/disk1s1. Replace disk1s1 with the correct slice corresponding to your volume. Use option 4 instead of 1 or run the command twice for a slightly more secure and time consuming wipe, but keep in mind that wiping is not particularly healthy for the drive, especially if it is an older model.
Enabling FileVault as soon as these drives are put in production will mitigate future issues with drive wiping, especially if the password is secure.
You could also try and boot from Parted Magic to issue a ATA or NVMe Secure Erase command, though it apparently hasn’t been implemented correctly on all drives. Let me know if you have tried this on Macintosh in the comments below.
Macs with third party user-installed solid state drives
Same as above, except TRIM is not enabled on these. TRIM can be enabled with the command sudo trimforce enable, though Apple does not recommend that in a production environment.
Macs with traditional hard drives
diskutil zeroDisk /dev/disk1 is sufficient and the fastest alternative.
Wipe the device and not the volume.
As with SSDs, start the macOS installer from an external drive and wipe from there.
Data recovery companies are not able to recover information that has been overwritten once with zeroes on modern hard drives, even though Peter Gutmann proved it theoretically possible with older media. Gutmann has since stated that a few passes of random is sufficient on modern media, and the inclusion of his 35-pass algorithms in modern drive wiping utilities is something of an artifact. If you have very high security requirements and are worried about possible non-public or future technologies, do a 3-pass random wipe instead:
diskutil randomDisk 3 /dev/disk1
With fusion drives, it is probably best to split the drive, use the recommended method above for each part, then unite the drive again. Let me know in the comments below if you have any experience with this.
SoundSnw 