You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Catalina on HDD MBPro: how to secure erase free space

I'm trying to learn how to securely wipe free space on the HDD of a MacBookPro 9.1, Quad-Core Intel Core i7 @ 2.60GHz, 16.0GB RAM that is running Mac OS X 10.15.7.


I've not succeeded using Terminal command "diskutil secureErase freespace <n> /Volumes/<volume name>".


Attempting to run the "Erase Free Space" tool on CCleaner (Free v1.18.30), after enabling Full Disk Access in System Prefs: nothing happens after selecting the volume, submitting my admin password, and clicking "Erase Free Space".


Any tips on what I'm doing wrong, or another approach? Thank you.



MacBook Pro

Posted on Mar 8, 2021 6:03 PM

Reply
Question marked as Top-ranking reply

Posted on Mar 9, 2021 9:01 AM

Since you are running Catalina the "Macintosh HD" contains the macOS system files which is located on a read-only APFS volume now. If you want to erase the free space you need to do so on the "Macintosh HD - Data" read+write volume containing the user folder(s). I believe with Catalina the default mount point is in "/Volumes".

About the read-only system volume in macOS Catalina - Apple Support


It would be easier to just enable Filevault so no one without your admin password would be able to access anything on the hard drive even if the laptop is booted to external media.

Similar questions

8 replies
Question marked as Top-ranking reply

Mar 9, 2021 9:01 AM in response to Macuser1696

Since you are running Catalina the "Macintosh HD" contains the macOS system files which is located on a read-only APFS volume now. If you want to erase the free space you need to do so on the "Macintosh HD - Data" read+write volume containing the user folder(s). I believe with Catalina the default mount point is in "/Volumes".

About the read-only system volume in macOS Catalina - Apple Support


It would be easier to just enable Filevault so no one without your admin password would be able to access anything on the hard drive even if the laptop is booted to external media.

Mar 8, 2021 6:51 PM in response to Macuser1696

I've heard that the Disk Utility GUI has removed the secure erase feature because the majority of Apple systems are now running SSDs where you have a limited number of lifetime writes available before wearing out an SSD. I don't know if "diskutil" is similarly affected even if you are using a hard drive. What error message do you get when issuing the command?

Mar 9, 2021 12:06 PM in response to HWTech

Thanks for continuing to help!


FileVault is enabled, so I do have the level of security you mentioned.


Nonetheless I'm hoping to figure out how to securely wipe free space on the HDD.


I checked Disk Utilities app and saw the volume structure you described.


The total hierarchy shown in Disk Utility is


APPLE HDD HTS727575A9E36 (SATA Internal Physical Disk • GUID Partition Map)

-> Container disk1 (APFS Container)

-> Macintosh HD (APFS Volume • APFS (Encrypted))

-> Macintosh HD - Data (APFS Volume • APFS (Encrypted))


I ran Terminal again, this time listing "Macintosh HD - Data" as the volume.


Command "diskutil secureErase freespace 4 /Volumes/Macintosh\ HD\ -\ Data"


returned "Could not find the disk /Volumes/Macintosh HD - Data"


Does that tell us anything useful, to solve for this quest?

Mar 9, 2021 4:31 PM in response to Macuser1696

Just checked a fresh Catalina install and the "Macintosh HD - Data" volume appears to be mounted at:

/System/Volumes/Data


I don't recall this so I wonder if a later update has changed the mount point. You may be prompted to allow the Terminal to access the volume (or some folders within it like the Desktop, and other folders).

Mar 9, 2021 8:27 PM in response to Macuser1696

I'm probably less technical than either of you, but my understanding is that it might be unsupported on SSDs for the reasons stated earlier...old-style secure erase passes are considered a waste of writes and SSD lifetime, especially when encryption is on, for the reasons expanded on below.


When encryption is on, the goal is already achieved already. What old-style secure erase passes achieved was obscuring the data previously written at those locations by overwriting them so that the next person who tried to read it would see gibberish. When good encryption is on, anyone who does not have the encryption key will see gibberish on the SSD, so the job is already done.


If the point is to "secure erase" specific memory locations even when encryption is off, that was easier with hard drives because their drive heads were much more likely to write files directly to specific memory locations as contiguously as possible. But the way SSDs work to do things like wear leveling, files are much more likely to be scattered in a million pieces distributed a lot more widely across the SSD...very difficult to recover even if unencrypted. Also, there is an abstraction layer between the OS and the controller that means where any software tells the SSD to write might not be exactly where they expect, making it difficult for a software utility to verify that you actually erased what you meant to. (Translation: A secure erase of an SSD cannot be guaranteed to be 100% effective) If the point is to secure an area when the encrypted SSD is currently unencrypted because a valid key was entered, some would probably argue that secure erase is pointless if someone already has access to the entire rest of the account.


The two links that were most informative on this are this one

https://apple.stackexchange.com/questions/146733/why-is-a-secure-erase-not-necessary-for-ssds


which led to this very informative one

https://security.stackexchange.com/questions/5662/is-it-enough-to-only-wipe-a-flash-drive-once/5665#5665


The role of the AES key is also interesting; even if you don't use FileVault it is still a key that is used with that abstraction layer, so if it's reset, nobody's going to recognize the data that used to be on that SSD anyway because the map connecting all the tiny scattered little pieces of data is gone.


After reading those I'm even more convinced that trying to secure erase an SSD is either not necessary, or not effective if attempted.

Catalina on HDD MBPro: how to secure erase free space

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.