IMRAN

Q: How to Secure Erase / Zero Out external hard drive in El Capitan?

Let me put on my Bite My Tongue mode on lest the censors here delete this thread as they seem to do if a frustrated user points out serious flaws in current versions of Mac OS El Capitan.

 

Maybe I am missing something, but the cartoonish Disk Utility is not showing me an obvious place to find an option to Secure Erase (zero out) an external hard drive. The unhelpful Help File clearly states it is "one of the secure erase options in Disk Utility" but I can't seem to find it.

 

Can someone please let me know where to look so I can zero out yet another defective Western Digital external drive.Horrible_UX_DiskUtility_Cartoonish_NoHelp_ZeroOut.jpg

 

Thanks.

 

IMRAN

MacBook Pro with Retina display, OS X El Capitan (10.11.1), 2X iPhone6S+/6+/4S,NikonD300.iPad3

Posted on Nov 26, 2015 7:37 PM

Close

Q: How to Secure Erase / Zero Out external hard drive in El Capitan?

  • All replies
  • Helpful answers

Page 1 of 3 last Next
  • by ckuan,

    ckuan ckuan Nov 26, 2015 7:49 PM in response to IMRAN
    Level 7 (33,782 points)
    Nov 26, 2015 7:49 PM in response to IMRAN

    There's none in El Capitan.

     

    For your external HD, do a format.

  • by IMRAN,

    IMRAN IMRAN Nov 26, 2015 7:54 PM in response to ckuan
    Level 2 (488 points)
    Notebooks
    Nov 26, 2015 7:54 PM in response to ckuan

    Thank you. Major disappointment. Mere format still leaves the data on the hard drive for someone else to recover.

     

    Making the UX even worse is that the Help information is false.

     

    Thanks for the input.

     

    Imran

  • by John Lockwood,

    John Lockwood John Lockwood Nov 27, 2015 2:24 AM in response to IMRAN
    Level 6 (9,314 points)
    Servers Enterprise
    Nov 27, 2015 2:24 AM in response to IMRAN

    There are various workarounds available.

     

    1. You could do this via the command line in Terminal.app just like you can do RAID operations to replace that lost functionality as well
    2. You can copy the Yosemite version of Disk Utility.app and hack that in to working
    3. You could connect the drive to a Yosemite (or earlier) Mac
    4. or You could create a bootable USB stick that does nothing but offer a secure erase facility - see this free tool https://www.paragon-software.com/home/dw-mac/
  • by Barney-15E,

    Barney-15E Barney-15E Nov 27, 2015 6:29 AM in response to IMRAN
    Level 9 (50,141 points)
    Mac OS X
    Nov 27, 2015 6:29 AM in response to IMRAN

    A fifth option is to encrypt the drive then format it as unencrypted.

  • by BobHarris,

    BobHarris BobHarris Nov 27, 2015 12:46 PM in response to IMRAN
    Level 6 (19,457 points)
    Mac OS X
    Nov 27, 2015 12:46 PM in response to IMRAN

    Disk Utility is not showing me an obvious place to find an option to Secure Erase (zero out) an external hard drive.

    I was able to zero an external drive.  And since erasing an external drive was your stated goal, why didn't you select an external drive instead of your internal Apple SSD?

    Screen Shot 2015-11-27 at 10.36.46 AM.pngScreen Shot 2015-11-27 at 10.36.53 AM.png

    And Disk Utility is not going to knowingly erase the boot drive, which it appears you have selected for you screen shot.

     

    And it turns out disk drives and SSDs make it extremely difficult to perform a true guaranteed secure erase, as the rotating devices perform sector replacement where knowledgeable individuals can recover data from it after a secure erase, and SSDs never write to the sector where the data is stored, then always write to a new sector, and must move the original sector to a garbage collection area, where again knowledgeable individuals can recover your data.  As a result it is not wise to declare something 'secure' when it isn't.

     

    Finally, writing zeros on an SSD, besides not actually zeroing what you think you are zeroing (as in it can leave a few gigabytes of your original data still accessible), the zeroing also shortens the life of the SSD.  SSDs have a limited number of writes per sector before the material physically wears out.  The SSD does wear leveling to help avoid this, but zeroing an entire SSD (or worse 7 or 35 pass random patterns), can seriously reduce the life of the SSD.


    With SSDs, it is better to operate them full time as FileVault encrypted drives and then as suggests, just do a reformat which will throw away the old encryption key and then sectors will just be a bunch of random bits.  No need to write any zeros and shorten the life of the SSD.

  • by IMRAN,

    IMRAN IMRAN Nov 27, 2015 1:18 PM in response to BobHarris
    Level 2 (488 points)
    Notebooks
    Nov 27, 2015 1:18 PM in response to BobHarris

    Well, Bob, during that time the disk I was trying to secure erase stopped mounting and failed so Disk Utility's screenshot showed the internal SSD as chosen. Whether writing zeros on an SSD shortens the life or if it matters to the user or not is the not stated question. But, yes, I would never do dozens of full write passes on limited writable life SSDs, but your comment about that will surely be useful to many. 

     

    I know the system won't let it format or erase my primary drive. But, here is the same Disk Utility with a different disk chosen (which I do not wish to erase but just chose it to take this screenshot). Your screenshot applies to some Recovery Partition, which is also not my stated target to secure erase. Can you tell me where you see the option to Secure Erase it for my external data disk in Disk Utility here?

     

    Thanks.

     

    Imran

    WhereIsSecureImageOptionInThisImage.png

  • by BobHarris,

    BobHarris BobHarris Nov 27, 2015 1:45 PM in response to IMRAN
    Level 6 (19,457 points)
    Mac OS X
    Nov 27, 2015 1:45 PM in response to IMRAN

    RecoveryPartition was just a partition on an external USB disk.  The key being it was on an "External" disk as you said you wanted to erase.  Just as your names do not mean anything to me, I don't expect my names for things to matter to you.

     

    If you look at my images, there is a "Security Options..." button that gave me the extra passes.  Your screen shot does not show that button.

     

    Now I was using a partition, and you are pointing at the entire disk.  That might make a difference to Disk Utility whether it shows the "Security Options..." or not.  This was done on an El Capitan system.

  • by Kurt Lang,

    Kurt Lang Kurt Lang Nov 27, 2015 3:10 PM in response to IMRAN
    Level 8 (37,820 points)
    Mac OS X
    Nov 27, 2015 3:10 PM in response to IMRAN

    To note, sector replacement regarding hard drives has nothing to do with erasing the data on them.

     

    When you secure erase an entire rotating hard drive with Disk Utility, it actually does overwrite each sector/block for as many passes as you choose. When you do a Secure Empty Trash, the areas of the drive where the data is stored are overwritten seven times with random data. There is virtually nothing that can recover anything from a seven pass erase. Not even proprietary lab equipment. And for the typical user, even a one pass erase is as good as gone.

     

    Sector replacement is a highly incorrect term that you'll find all over the web. There is no such procedure. A drive has as many sectors on it that it will ever have when it ships from the factory. It can't create more from out of nowhere.

     

    When you have bad blocks/sectors on a drive, the drive's own firmware will attempt to move the data in the corrupt area of the drive to a new location. Whether it succeeds or not, there is a small area of the drive set aside for mapping out bad blocks/sectors. It's no different than any other part of the drive as far as holding data, except neither the OS or you are allowed to touch it. The drive keeps track of all bad sectors/blocks in the user area of the drive so nothing is ever written to them. As the drive develops more bad areas and are mapped out, the fixed amount of space the drive has to keep track of these areas fills up. When it has no more room to write bad block data, the drive must be thrown away.

  • by Old Toad,

    Old Toad Old Toad Nov 27, 2015 3:12 PM in response to IMRAN
    Level 10 (141,125 points)
    Mac OS X
    Nov 27, 2015 3:12 PM in response to IMRAN

    There is a secure erase in Disk Utility for non SSD hard drives.

     

    1 - select the disk in the sidebar.

    2 - click on the Erase button:

    3 - click on the Security Options button:

    Disk Utility001.jpg

     

    4 - select the level of secure erase in the next window:

    Disk Utility002.jpg

     

    Again, that option does not appear if the disk is an SSD.

    OTsig.png

  • by IMRAN,

    IMRAN IMRAN Nov 27, 2015 5:39 PM in response to Barney-15E
    Level 2 (488 points)
    Notebooks
    Nov 27, 2015 5:39 PM in response to Barney-15E

    Thank you, that sounds like a possible workaround. I wonder if it will take a bit longer than a straight forward Write Zeros. But thank you for the interesting suggestion.

     

    Imran

  • by IMRAN,

    IMRAN IMRAN Nov 27, 2015 5:40 PM in response to Old Toad
    Level 2 (488 points)
    Notebooks
    Nov 27, 2015 5:40 PM in response to Old Toad

    Thanks, OT. I am not seeing that Security option in my case. And none of my externals is an SSD.

  • by IMRAN,

    IMRAN IMRAN Nov 27, 2015 5:41 PM in response to BobHarris
    Level 2 (488 points)
    Notebooks
    Nov 27, 2015 5:41 PM in response to BobHarris

    I had thought of that and also tried clicking the partition, Bob, I should have stated that in my comment but here is a screenshot to show that even in that case I am not seeing the option.

     

    WhereIsSecureImageOptionInThisImage2.png

  • by IMRAN,

    IMRAN IMRAN Nov 27, 2015 5:42 PM in response to Kurt Lang
    Level 2 (488 points)
    Notebooks
    Nov 27, 2015 5:42 PM in response to Kurt Lang

    Glad you posted that, Kurt. Thank you.

  • by IMRAN,

    IMRAN IMRAN Nov 27, 2015 5:44 PM in response to John Lockwood
    Level 2 (488 points)
    Notebooks
    Nov 27, 2015 5:44 PM in response to John Lockwood

    Hi John, thanks for the list of suggested ways to try to workaround the problem.

     

    Ideally I would just love to be able to use the old non-cartoonish Disk Utility. You wrote:

     

    - You can copy the Yosemite version of Disk Utility.app and hack that in to working

     

    Any instructions on how to actually do that?

     

    Regards

     

    Imran

Page 1 of 3 last Next