You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Secure Empty Trash missing on El Capitan

Just installed El Capitan and discovered that the Secure Empty Trash feature is missing. Anyone know how to get this back?

Posted on Sep 30, 2015 2:42 PM

Reply
212 replies

Oct 3, 2015 12:46 PM in response to John Galt

This is what I hear: "You can't secure empty trash, bla bla bla bla." With all due respect, this does not help me. That's a why the problem exists response, not a how to fix the problem response.


So I appreciate the reply, but it doesn't address the problem.


You say its possible under FileVault. Okay... how can we set it up so the entire OS is under FileVault thus returning the functionality.

Oct 3, 2015 3:08 PM in response to Starry001

File Vault does not delete files. What he is getting at is that, after you install OS X, and before you place any files on your SSD, you should enable File Vault's full disk encryption. This is found in System Preferences -> Security & Privacy -> File Vault. This will begin the process of encrypting your entire SSD using a password.


I am going to keep things very simple here as the underlying technology at work is complex. Basically, once the process of encrypting your entire SSD is complete all files on it and those you add to it will be stored encrypted. When you log into you Mac it will use your password as a key to 'unlock' your encrypted disk (again keeping this explanation simple) and you will see your files like always. You will be able to create new files, modify files and delete files as always.


If someone takes your disk, or turns on your laptop and they don't know your password they will not be able to access any files on the disk as they are encrypted. So for all intents and purposes to someone without the password the disk contains a bunch of random 0s and 1s that don't make up anything useful.


So using File Vault does not exactly give you secure delete functionality in the same sense as what secure delete did. However, by using it no one (without the password) will be able to access your file whether or not you delete it with regular 'non secure' delete or if you never delete it from the encrypted disk.


To me this is still somewhat less secure then explicitly secure deleting the file because secure delete would not only write random bits to the file (essentially what an encrypted file looks like when it is 'locked') but it would repeat this process multiple times. This is important with 'old fashioned' hard drives (non-SSD) because when you write a file to them, even if you overwrite the file with random bits, there is still a physical residual magnetic signature which can be used to recover them. The more times you write random bits over it the harder and harder it becomes to read the original signature. Think of it like you dripped some spaghetti sauce on your white shirt. You spray it with oxyclean and wash it. The first time you take it out of the wash you can still make out some of the stain. That's the residual signature that can be used to recover your deleted file. So you spray it again and repeat the wash. The next time there's even less of a stain. You rinse and repeat until you can't see it anymore.


However, the problem with that approach with SSD (flash) drives is that flash memory/drives physically store data differently than a traditional magnetic hard drive does. In addition sophisticated controller software is used to manage how and where data is written to and deleted from them to ensure performance and longevity. Again all needed due to the underlying physical characteristics of flash based storage. In short, unless you use tools from the flash drives' manufacturer for secure deletion, there is no way for an operating system to directly guarantee secure deletion. Again, I am keeping things very simple here. If you want to learn more Google is your friend (secure delete SSD).


So I can understand the general principal of removing the option, however, many people still use non SSD drives like external USB, SCSI, Firewire etc. and may want to securely delete a file from it. From that standpoint this is a loss of convenient functionality. For those folks your best bet is either a 3rd party utility if you want a GUI, or use the 'srm' command from the terminal. Neither option is quite as convenient as the original functionality was.

Oct 4, 2015 6:49 AM in response to jDavis3

It is absolutely their right. Just as it is your right not to buy the computer.


It's not a matter of agree or disagree, anyway. Apple cannot offer this to SSD owners. Listen to NBW! Read the long post he made a page back. It explains everything. I think John Galt has also explaining why SSDs cannot secure empty trash and I think a few others.


Now if you have a hard drive, the terminal command `srm` is functionally the same. However, unless the file you're trying to secure delete exists for a very short time or something, I suggest also encrypting it during its lifetime (then secure deleting it when you no longer need it).

Secure Empty Trash missing on El Capitan

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.