How does Apple erase data on returned Macbook Airs?

Question

Level 1

0 points

How does Apple erase data on returned Macbook Airs?

I returned my new 2011 Macbook Air and the Genius in-store performed some kind of a wipe where the screen went black, and all you could do is type commands (no mouse activity). He said he was performing a script to delete the data.

The letters showed: “delete ‘my username’? Y/N”. He typed in “Y” for yes and the computer began restarting.

Now this confuses me a bit. If I were to manually delete all of my files (dragging them into the trash bin) and then deleting them, it would have taken a longer time than what took place in the script. The tech’s process took about 5 seconds or so.

I know that no data-wipe is fool-proof, but with the SSD’s, it's especially hard because there’s no 7-Pass Wipe option/DBAN, etc. Which makes me even more paranoid that the wipe wasn't even a quick-erase, but some other generic wipe, IE: just deleted the User folder, but retained all files.

Does anyone know what they usually do with the data in returned Airs, or if this is the standard operating procedure?

Thanks.

Posted on Sep 28, 2011 3:31 AM

Reply

Answer 1

Sep 28, 2011 3:43 AM in response to yoocla

Yep guess what? They don't, or at least the ones at the Genius bar don't - mostly out of ignorance would be my guess. If the device is sent to Apple for refurbishment, I'm sure they wipe it though.

I was ****** when I had to return mine after moving all my personal documents. The best thing to have done would be create a whole new dummy user account and then do a Secure Empty of the trash with your other user profile in it. I did a Secure Empty for all my personal files and figured it was as good as I was going to get on short notice.

You also have the ability through Disk Utility to do a Secure Erase of the whole drive (boot to install media to do it) and could do a KillDisk/DBAN for the whole drive then reinstall the OS.

If it only took 5 minutes and you had a decent amount of data, I would assume it was not a Secure Erase - this does a 3 pass deletion (from the GUI at least) and takes a bit longer.

Reply

Answer 2

Sep 28, 2011 8:28 AM in response to TheMuffnMan

Unfortunately, Secure Erase, when initiated from the same drive as is certain files are being arased, is less than complete on an SSD. While you may see the process happening, it is skipping pages of memory wherein said pages reside in a block alongside kept file data. You see, the OS can't write anything to a page that has been marked unused (via the first step of deletion), until the entire block in which it resides is similarly vacated of use. In order to actually erase a partially used block, any "in-use" memory pages must be first moved. Secure Erase does not perform this action, because it is designed for a disimilar controller methodology as used in conventonal hard drives.

If at all possible, boot from an external drive, and perform a overwiting erase/multiple pass on the entire drive. You simply can't target single files for deletion on an SSD and accomplish multiple pass overwrite.

Reply