I'm preparing an iMac running Ventura for trade-in and want to do a secure erase using the secureErase option of the diskutil command via the Terminal app. Has anyone done this and know how to format the command?
iMac 21.5″, macOS 10.15
That function does not work on SSDs. That's why you can't find it in Disk Utility.
For a Mac’s boot drive, Peter Cohen explains the process nicely. “How to Securely Erase a Mac SSD.” In brief:
1) Back up any data you want to keep on your boot drive. It’s going to be nuked.
2) If you haven’t already, go to System Preferences > Security & Privacy > FileVault and enable it. Write down the password on paper and establish a safe place for this password. Be patient. This process can take a long time, hours, and there is no progress bar.
3) When done, restart your Mac in Recovery mode (CMD-R) as described at the beginning of this article.
4) Launch Disk Utility. Select the disk (boot SSD). Select Unlock “volume name” from the File menu. Enter that saved password. Now erase the disk normally, using the standard erase option.
5) This deletes the FileVault key. The SSD now contains only unreadable, encrypted garbage.
6) You may wish to install some version of macOS now to place the machine in the out-of-the-box mode. Do CMD-Q when the Mac reboots and the set up process first starts.
I've done this, and step 2 did not take hours. Not even on a 1 TB drive. It was done in all of a couple of minutes.
That function does not work on SSDs. That's why you can't find it in Disk Utility.
For a Mac’s boot drive, Peter Cohen explains the process nicely. “How to Securely Erase a Mac SSD.” In brief:
1) Back up any data you want to keep on your boot drive. It’s going to be nuked.
2) If you haven’t already, go to System Preferences > Security & Privacy > FileVault and enable it. Write down the password on paper and establish a safe place for this password. Be patient. This process can take a long time, hours, and there is no progress bar.
3) When done, restart your Mac in Recovery mode (CMD-R) as described at the beginning of this article.
4) Launch Disk Utility. Select the disk (boot SSD). Select Unlock “volume name” from the File menu. Enter that saved password. Now erase the disk normally, using the standard erase option.
5) This deletes the FileVault key. The SSD now contains only unreadable, encrypted garbage.
6) You may wish to install some version of macOS now to place the machine in the out-of-the-box mode. Do CMD-Q when the Mac reboots and the set up process first starts.
I've done this, and step 2 did not take hours. Not even on a 1 TB drive. It was done in all of a couple of minutes.
Assuming you enabled FileVault Use Disk Utility to erase an Intel-based Mac - Apple Support is literally all you need to do. For the purposes of trading it in, it is not necessary to reinstall macOS as What to do before you sell, give away, trade in, or recycle your Mac - Apple Support suggests. Just shut down the Mac after you finish erasing it.
The Recovery version of Terminal will not offer any options other than those available in the Disk Utility version it uses. Quoting the manpages (emphasis added):
NOTE: This kind of secure erase is no longer considered safe. Modern devices have wear-leveling, block-sparing, and possibly-persistent cache hardware, which cannot be completely erased by these commands. The modern solution for quickly and securely erasing your data is encryption. Strongly-encrypted data can be instantly "erased" by destroying (or losing) the key (password), because this renders your data irretrievable in practical terms. Consider using APFS encryption (FileVault).
Hmm. The Disk Utility should have the option to secure erase the drive. But you of course can't erase the drive out from under yourself when it's also your startup disk.
You should be able to boot into Recovery Mode, and then use ** to secure erase the drive. A single overpass is sufficient as recovery tools the average can get cannot recover anything from a drive that has been overwritten with random ones or zeros even just once.
Or, while in Recovery Mode, you can choose to encrypt the entire drive, then do a simple erase. That will wipe out any recovery key. Follow that with a fresh install of the OS. Anything not overwritten will be unretrievable, encrypted data.
FileVault is whole disk encryption.
The only thing it would not get on a rotating hard disk are bad sectors, that have been replaced by spares.
But, then again, secure erase will not touch the bad sectors either.
Thank you for the reply. The iMac I'm preparing for trade-in doesn't have an SSD, just an HD. About FileVault, my understanding is that it doesn't encrypt previously deleted data which may still reside on the HD.
Has anyone used the secureErase option of diskutil via the Terminal app?
