What information persists after system restoration?

Question

Level 1

8 points

What information persists after system restoration?

I'm a guy who is pretty experienced dealing with Windows but quite a novice on the Mac.

A current project is to help someone who fears having had malicious software secretly installed on a couple of their Macintosh computers. The one I'm experimenting with is a MacBook Air. My first attempt at system restoration involved booting into the recovery system and using it to erase, which I think means reformat, the partition used to run OSX. Subsequently the system was restored to this partition, which seemed to involve the Recovery System downloading from the Apple Store what ever files are needed and rebuilding the system.

The result appears to be a pretty clean system but to my surprise there seems to be some information present that could only have come from the former system, which I'm trying to replace. Insofar as I was expecting the operation to completely restore the system to the same state it would have been if newly purchased this result causes me to ponder what else may not have been restored. My objective is to be confident that the system has no extraneous software installed when I get done with this operation, which is something I cannot say with confidence now.

A plausible explanation is that I don't understand how certain devices on the Mac work and that the persistent information pertains to the preservation of state within attached devices. In this case what I've recognized is that there are bluetooth devices, formerly used on the computer, that the system (e.g., OSX) seems to be trying to find. Why is that? If my surmise is correct, how is one supposed to learn about the behavior of such devices? In that, what else has been left on the computer? How can I completely restore the computer to it's initial state?

MacBook Air, OS X Mavericks (10.9)

Posted on Aug 29, 2015 11:38 AM

Reply

Answer 1

Csound1

Level 9

59,973 points

Aug 29, 2015 11:42 AM in response to arrividerci

If you erase the disk nothing remains of previous installations. Just like it would be on a Windows machine.

Reply

Answer 2

babowa

Level 9

78,103 points

Aug 29, 2015 1:42 PM in response to arrividerci

If you simply use recovery to download/install the OS, it will just install it over the top of what you have. If you want a "factory fresh" system, you need to use Disk Utility in the recovery/Utilities window to erase the drive; when that is done, choose reinstall. Since the drive will be erased, you will get the original OS version reinstalled (if that is a different one from what is installed currently); during the initial install/setup phase, be sure to have the owner set it up with THEIR AppleID and password as any OS obtained from the app store is tied to the Apple ID used to obtain it and it is not transferable. So, do not use yours as that would result in some annoying problems for the owner.

Reply

Answer 3

arrividerci Author

Level 1

8 points

Aug 31, 2015 9:39 AM in response to babowa

I did just what babowa described (i.e., erase and reinstall using owner's Apple ID). However, the result is not what I would consider clean. With minimal inspection I was able to find residual information that pertained to prior usage. This causes me to ponder what a more thorough inspection may find. It does not produce confidence that the objective, getting rid of all prior results, has been achieved.

What I can see is data describing bluetooth devices. It even appears as though the system is trying to connect to them but cannot since they are not presently available but I certainly would not expect nor want such to occur if they were available.

What's going on? How can I restore the system to its' original state?

Reply

Answer 4

Csound1

Level 9

59,973 points

Aug 31, 2015 9:43 AM in response to arrividerci

Erasing the drive and reinstalling the OS will return the system to it's original state.

Reply

Answer 5

arrividerci Author

Level 1

8 points

Aug 31, 2015 9:59 AM in response to Csound1

As I said it did erase a lot of stuff but NOT everything. Is it possible that the bluetooth device/adapter would maintain its' own state information (i.e., independent of OSX). If so then there ought to be a way to reset such a device. If bluetooth acts this way what else might also exhibit such characteristics. Resetting all such devices would be an important aspect of the kind of system restoration that is desired here.

Reply

Answer 6

Csound1

Level 9

59,973 points

Aug 31, 2015 10:02 AM in response to arrividerci

Then it failed to erase or you did it wrong, an erasure is absolute. The drive will be empty afterward. Do it again.

Reply

Answer 7

John Galt

Level 10

141,150 points

Aug 31, 2015 10:48 AM in response to arrividerci

Refer to What to do before selling or giving away your Mac.

Some of the following will not apply if you already erased it, but review everything since as others have already noted, nothing will remain if you do it properly. Skip Step 5 since the MBA has no optical drive.

If you enabled FileVault, disable it in System Preferences > Security & Privacy.
"Deauthorize" your iTunes account. Same for Audible if you have one.
System Preferences > iCloud > de-select "Back to My Mac" and "Find my Mac".
Sign out of iCloud. Select "Delete from Mac" when it appears.

Next: Remove all your personal information by completely erasing the Mac's internal storage.

If your Mac shipped with a grey System Install DVD, start your Mac with that disc inserted in the optical drive while holding the c key to boot from it instead of its internal volume, which should be erased before selling it.
If your Mac did not ship with discs, boot OS X Internet Recovery:
- using three fingers press and hold the following keys: ⌘(command), option, and R.
- With a fourth finger press the power button to turn on the Mac.
- Keep the other three fingers where they are until you see the "spinning globe" icon.
- This method forces the Mac to download its originally installed OS from Apple's servers, which will not require an Apple ID to install.
Remove any Open Firmware password if you created one: select Firmware Password Utility from the Utilities menu and remove it.
Select Disk Utility from the Utilities menu.
Remove any partitions you may have created.
Select the Mac's hard disk icon, then select the "Erase" tab.
Select the "Security Options" button and erase the disk.
- The more "securely" you erase the disk, the longer it will take.
- The fastest method is sufficient since all but the most expensive techniques and equipment will be able to recover securely erased data.
When it finishes, quit Disk Utility.
Select Install Mac OS X from the Utilities menu.
- An Apple ID will not be required. If a prompt for an Apple ID appears, return to Step 5.
- Do not create any user accounts.
When it finishes, shut down the computer.

Reply

Answer 8

babowa

Level 9

78,103 points

Aug 31, 2015 1:50 PM in response to arrividerci

As I said it did erase a lot of stuff but NOT everything.

Then you did not erase the drive. If you boot into internet recovery (hold Command + Option + R until you see a progress bar, then wait up to 15 minutes until it connects to Apple's servers), you wind up with a Utilities window - use Disk Utility there to re-partition the drive (choose 1 partition and it will erase automatically). It will erase it completely. There will not be anything left on the drive. You then choose to reinstall OS X. That will be the only thing on the drive. Do not port over anything during the setup process; either use the owner's ID and password (which really isn't a good idea to give someone your password), or set up a non-descript account with a password of "12345" and let the owner set up their own afterwards.

Reply