How to *safely* sell a Mac with an SSD or Fusion Drive?

Hi all -

My apologies if I'm posting this in the wrong group. Please re-direct me if I am.

As I'm sure most of you know, you can't Secure Erase an SSD or Fusion Drive like you would an HDD. I've read the science behind why that's the case, but this seems like a huge security (and reseller) problem for people who intend to sell their old macs and buy new ones in the coming years.

If we can't securely erase our drives, how can we expect to sell these computers with peace of mind? With essentially all new Mac's coming with an SSD or Fusion Drive, it seems like we'll all be in the same boat sooner or later.

My question is, how are you all selling your SSD or Fusion Drive Macs in a relatively safe manner? I know that it's near impossible to to guarantee 100% data erasure, but I'm curious what others are doing and where they are drawing the line.

I'd currently like to sell an iMac with a Fusion Drive.

I've read about encrypting your SSD via FileVault and essentially throwing away the key, but i've also read that FileVault can easily be cracked now?

Seems there are other ways to wipe the data, but they may greatly reduce the life of the SSD or Fusion Drive - which I don't think is fair if I intend to sell it shortly after. I'm an honest salesman I guess.

Thanks in advance.

Thanks for the quick replies already.

For what it's worth, here is where I read about FileVault2 being crackable:

http://www.macworld.co.uk/news/mac-...encryption-cracked-forensic-software-3334858/

Granted, we're talking about a $1K piece of software here, and perhaps this means that the clean install will remove the key from memory?

"The technique requires certain conditions to work, starting with the computer being turned on and logged in; the FileVault, BitLocker or TrueCrypt keys have to be in memory for Passware Kit Forensic to be able to extract them.

Put another way, the product cannot extract encryption keys on static data or before the keys have been summoned as part of the logging-in process. As long as the login is not automatic users should be safe."

Weaselboy said:

That is really old info. That technique uses direct memory access (DMA) to access the encryption keys, and that was patched in Lion 10.7.2. It is no longer an issue.

Click to expand...

Gotcha - well, I appreciate yours (and everyone's) info. Sounds like FV2 encryption, erase, and reinstall is the way to go.

Thanks!

Chippy99 said:

I forgot to add, that above is the best method.

Other methods - such as encrypting the drive, or writing zeros all over it like a Mac Disk Utility does, will NOT destroy the on the entire drive! This is because SSD's have spare capacity and use wear-levelling to increase the drive lifespan. What the OS sees is only the logical portion of the drive that the SSD controller chooses to show, i.e. there are hidden physical blocks that may contain copies of your data and which any software-based wipe will be unable to touch.

It is not easy to access the data in these hidden blocks, but it's not impossible. So you are probably secure, but it depends how safe you want to be. The FBI or perhaps even the regular police could retrieve this data if they wanted to.

The ATA-Secure-Erase, wipes the ENTIRE SSD, including the hidden blocks.

Click to expand...

Gotcha - thanks for the info. Do you know if Parted Magic will work okay with an iMac Fusion Drive where both an HDD and SSD are used and presented as a single logical drive? I don't want to break that relationship, and once I've re-installed the OS, I'd like for the two drives to still work together as a Fusion drive.

So! In case anyone is interested, here is what I did and it worked beautifully.

1) Burned Parted Magic to a CD and booted from that (holding "c" during the boot sequence).
Note - I originally created a Parted Magic LiveUSB, but my iMac wouldn't recognize or boot from it. I did some research, and apparently other people have had the same issue. I recommend the LiveCD.

2) Once in Parted Magic, I opened the application "Erase Disk" on the desktop, which recognized both the SSD and HDD as separate drives (despite that I did not break apart the Fusion Drive). I issued an internal "Secure Erase" command against the SSD, as well as a physical (dd) erase command against the HDD. I also issued an internal "Secure Erase" command against the HDD, although I'm not sure how that differs between HDD and SSD. In any case, the Parted Magic documentation says it's supported.

3) With the disks erased, I rebooted into Apple Internet Recovery (command+r). I first opened Disk Utility, which flagged both drives as having an issue. However, here is the cool part: It still knew that they were supposed to be a Fusion Drive and offered to repair it. One click and it was back to being a Fusion Drive in a few seconds.

4) Still in Internet Recovery, I re-installed Mac OS X to the Fusion Drive.

5) Once re-installed, I ran Apple Diagnostics which returned with "no issues found"

In all, it was very painless. I'm sure that encrypting the disk and reformatting would have been enough security, but this way, I know with absolute certainty that my data is gone. From what I understand, there is no coming back whatsoever from an ATA Secure Erase.

The usual disclaimer: This worked for ME, but I in no way state that this will work for anyone else. Try at your own risk.

Thanks everyone for your help!

Chippy99 said:

Presumably you had to put your Mac to sleep to unlock the SSD? I had to, but it all worked just fine.

Click to expand...

Yep, exactly. I put it to sleep via the application, brought it back up by tapping a few keys, and it was unlocked.

I also found that Parted Magic wouldn't recognize the Bluetooth keyboard, however, it would recognize the Bluetooth mouse!