after erasing my hard drive, how do I confirm that the data has been erased?
After erasing my hard drive, how do I confirm that the data has been erased?
MacBook Pro 15″, macOS 10.14
After erasing my hard drive, how do I confirm that the data has been erased?
MacBook Pro 15″, macOS 10.14
davidfromforestburgh wrote:
after erasing my hard drive, how do I confirm that the data has been erased?
You specifically mentioned a hard drive (not an SSD) and I assume you did not have File Vault enabled.
If you did a quick erase your files still exist on the drive even though you cannot see them or access them through normal means. But they could be recovered by any number of data recovery apps.
You need to use at least one of the Security Options in Disk Utility for greater control over erasing. You should erase a hard drive with at least 1 pass writing to the disk in order to actually erase files. Better still, writing over the data three times meets the U.S. Department of Energy standard for securely erasing magnetic media and writing over the data seven times meets the U.S. Department of Defense 5220-22-M standard. However the more writes the longer the process takes.
As far as checking/confirming that data has been erased you could use the demo version of Prosoft Data Rescue 6 to scan your drive and visualize the results including previewing any files it finds. It would show you whether or not any files remain that could be recovered (but the demo version does not do any actual recovery).
davidfromforestburgh wrote:
after erasing my hard drive, how do I confirm that the data has been erased?
You specifically mentioned a hard drive (not an SSD) and I assume you did not have File Vault enabled.
If you did a quick erase your files still exist on the drive even though you cannot see them or access them through normal means. But they could be recovered by any number of data recovery apps.
You need to use at least one of the Security Options in Disk Utility for greater control over erasing. You should erase a hard drive with at least 1 pass writing to the disk in order to actually erase files. Better still, writing over the data three times meets the U.S. Department of Energy standard for securely erasing magnetic media and writing over the data seven times meets the U.S. Department of Defense 5220-22-M standard. However the more writes the longer the process takes.
As far as checking/confirming that data has been erased you could use the demo version of Prosoft Data Rescue 6 to scan your drive and visualize the results including previewing any files it finds. It would show you whether or not any files remain that could be recovered (but the demo version does not do any actual recovery).
If you perform a simple erase using Disk Utility on an original Apple SSD, then the SSD will immediately be zeroed due to TRIM being activated. I'm not certain about third party SSDs since TRIM is not always enabled plus if it is enabled, then it is not likely TRIM will be enabled when booting from the macOS installer. Even so, the SSD will most likely be zeroed if the SSD is left powered on long enough for the SSD's internal garbage management routines to process all the now unused blocks.
If you have a macOS boot drive you can try reading the raw blocks from the SSD using the macOS "xxd" command line utility (I'm not sure the utility is available while booted to the macOS installer). Of course some SSDs will report zeroes even if the drive isn't completely erased yet, but that is the best you can do without high end equipment to access each NAND block on the SSD.
xxd /dev/diskX
or maybe even:
xxd /Volumes/<mounted-volume-name-of-erased-SSD>
You must replace the "diskX" with the proper drive identifier for the physical SSD or replace "<mounted-volume-name-of-erased-SSD>" with the proper volume name you used when erasing the SSD. In both cases you may see some blocks containing data, but that will just be the partition and directory information that Disk Utility puts on all erased drives, but very quickly you will see nothing but a row of zeros and the utility will appear to be frozen since it won't repeat all the zeroes it is actually reading (or the SSD's controller is only reporting that and nothing else).
Of course as others have already mentioned first enabling Filevault and letting the encryption process complete before using Disk Utility to erase the SSD is definitely the surest method if you have any doubts. I wouldn't even unlock the Filevault when erasing the drive since you can just select the physical SSD (should be called something like "Apple SSD"). You may need to first click "View" within Disk Utility and select "Show All Devices" so the that the physical drive appears on the left pane of Disk Utility (necessary when booted from macOS 10.13+).
davidfromforestburgh wrote:
After erasing my hard drive, how do I confirm that the data has been erased?
With the Secure enclave both Apple T2 Security Chip and the M1 —once you erase the SSD the cryptographic keys for recovering any data are gone.
Secure Enclave - Apple Support
Apple T2 Security Chip: Security Overview
What to do before you sell, give away, or trade in your Mac
SSDs are a different matter. Have a look at this article about how erasing SSDs:
How to Securely Erase Your Mac's SSD
It also refers to an article written by the EFF (Electronic Frontier Foundation) about how to securely erase Mac drives. Scroll to the bottom of the article for background about how SSDs store data and why it's difficult to securely erase them.
For what it's worth, when I have a drive that I am finished using (HD, SSD or Flash) and want to be totally certain it is erased & unusable, I disassemble it and take a hammer & scraper to all the platters and chips! Sometimes the old tools are the best.
A point here regarding erasing an SSD drive.
SSD Data Recovery, my most Normal Means is very questionable at best. Even Professional Date Recovery Companies will caution the Client of this fact. They, may be able to recover some Data, but that is the Best they can do.
Now, Rotational / Platter HD is a different matter and has a higher recovery rate.
Thank you
Thank you, but I should have been clear that I have an intel chip in my Mac book.
Thank you Martin , I am old and used to hard drives, just remembered my Mac book has an SSD. I did an erasure thru os recovery as instructed , but I just wanted to know if the data is erased.
Thanks, good information .
Thanks for the follow up.
Thank you!
after erasing my hard drive, how do I confirm that the data has been erased?