I sold my Mac mini last year and I'm scared

[Kolok]

Before selling it I remember that I formatted it, (I have a screenshot I had taken, I hope that's what it is)

But now that I've been trained in security and I've seen that the best thing to do is to overwrite the left space data, I've become paranoid and I don't want to sell any more equipment, but I've already sold it and I'm afraid that someone might recover the data with special programs. (I had work documentation)

Do you think that macOs performs some kind of overwriting when formatting?

 

[EugW]

It does not, but don't worry about it, unless you work for the secret service and the person who bought it from you knows that.

 

[jb310]

I'm afraid that someone might recover the data with special programs

I think the chances of you selling your Mac to someone with these "special programs" is ridiculously low, unless you live in a hotbed of cybercrime or right next door to a spy agency or something.

 

[frou]

If it was an Apple Silicon Mac or new-ish Intel Mac then I think the data is automatically encrypted on the fly, so it's basically "white noise" on the disk. Writing over with zeroes is the old-school approach and not that relevant these days.

 

[Kolok]

If it was an Apple Silicon Mac or new-ish Intel Mac then I think the data is automatically encrypted on the fly, so it's basically "white noise" on the disk. Writing over with zeroes is the old-school approach and not that relevant these days.

Yes, was a mini M1 256GB

The screenshot above confirms that it is formatted?

 

[Phonzoxd]

this is same reason i didnt sell my laptop a year or 2 ago. instead just gave it to my sis.

 

[Kolok]

this is same reason i didnt sell my laptop a year or 2 ago. instead just gave it to my sis.

I've read that if it's an Apple ssd, the Trim feature fills the empty space with zeros, so there wouldn't be a problem, but I CAN'T CONFIRM IT, I've read it here:

How to erase HD safely - Apple Community

discussions.apple.com

 

[kitKAC]

https://support.apple.com/en-gb/guide/security/welcome/web

Read through the Apple Platform Security guide.

 

[Kolok]

https://support.apple.com/en-gb/guide/security/welcome/web

Read through the Apple Platform Security guide.

Thanks a lot.

Last question, the picture I posted confirms that it really was a clean install or could it also be a monterrey reset without wiping the data?

The WiFi icon is making me hesitate, it's been a year and I can't remember how I did it, I always tend to format my devices but I'm hesitating....

 

[Adora]

Your data was encrypted. At least that's standard setting for some years now. I wouldn't worry about that. Also the chance is very low, that someone who wants your data bought it.

In earlier times when you had an unencrypted HDD it was recommended to overwrite all data, maybe even several times. There was an option in DiskUtility to do the long format a few times in a row. Don't know if it's even still there.

Even if someone could restore the whole drive he can't log in without your password and confirmation.

 

[Phonzoxd]

Your data was encrypted. At least that's standard setting for some years now. I wouldn't worry about that. Also the chance is very low, that someone who wants your data bought it.

In earlier times when you had an unencrypted HDD it was recommended to overwrite all data, maybe even several times. There was an option in DiskUtility to do the long format a few times in a row. Don't know if it's even still there.

Even if someone could restore the whole drive he can't log in without your password and confirmation.

alot of times, say if you sell on ebay for laptops, its companies that buy your stuff and resells it.

When i listed my laptop (which i delisted) it was all these companies reaching out to buy from me. Like 3 dms within an hour of me listing it.

They know what they are doing.

 

[Phonzoxd]

i think a solution, and i could be very very wrong is to write over the entire drive from empty to full. Just find big files and copy and paste until it fills up.

 

[ApplesAreSweet&Sour]

Obviously, any data that might help someone log into your bank account or something similarly important would be detrimental in the wrong hands.

But, unless you're some very important government worker, or celebrity, politician, etc., what would be on your Mac that has you "scared"?

Did you have images from the dark web, like illegal 🌽 on there or something?

Let me assure you, if you're just some John or Jane Doe, like most of us, then you and the contents of your devices is most certainly not important to anyone but yourself.

 

[AlixSPQR]

Is File Vault removed from Si Macs, since the data is encrypted anyway?

 

[PsykX]

It's a lot of effort and knowledge.

If the buyer knows you and knows you worked on something secret and valuable enough, I can understand your concern.
If you're just a random dude / dudette who has a normal life and nothing to hide, you shouldn't worry about it.

 

[chrfr]

Before selling it I remember that I formatted it, (I have a screenshot I had taken, I hope that's what it is)

But now that I've been trained in security and I've seen that the best thing to do is to overwrite the left space data, I've become paranoid and I don't want to sell any more equipment, but I've already sold it and I'm afraid that someone might recover the data with special programs. (I had work documentation)

Do you think that macOs performs some kind of overwriting when formatting?

On Apple Silicon Macs, and Macs that use a T2 chip, the data on the disk is encrypted even if you don't enable Filevault. Nobody's getting your data back because when you erase the disk, the encryption keys are deleted.

 

[iHorseHead]

But it's still possible to recover the data on the disk even after formatting it and reinstalling the OS. I know it because my coworker recovered some Word document that some customer needed. It was also M1 MacBook Pro. It wasn't as easy and it took him several days.

I don't think anyone would care though. I mean if you sold your M1 Mac mini to me or to most people, I think they wouldn't care. Even if you left everything on there and didn't format the disk. I wouldn't go to your personal files but I'd just reinstall the OS.

Years ago I bought a used Mac and they didnt format the hard drive. It was running OS X Lion and it signed in automatically. It had some apps on the dock and a different wallpaper and some files on the desktop, but I didn't care. I immediately restarted the laptop and went to disk utility, wiped the hard drive and reinstalled the OS and then after that was done I downloaded OS X Mavericks from the Mac App Store and installed it. I think most people would do what I did. I wouldn't care about your personal files at all.

 

[iHorseHead]

Your data was encrypted. At least that's standard setting for some years now. I wouldn't worry about that. Also the chance is very low, that someone who wants your data bought it.

In earlier times when you had an unencrypted HDD it was recommended to overwrite all data, maybe even several times. There was an option in DiskUtility to do the long format a few times in a row. Don't know if it's even still there.

Even if someone could restore the whole drive he can't log in without your password and confirmation.

If FileVault is not enabled they can create a new admin account / change the password and through that they could reset the user password as well.

 

[eltoslightfoot]

But it's still possible to recover the data on the disk even after formatting it and reinstalling the OS. I know it because my coworker recovered some Word document that some customer needed. It was also M1 MacBook Pro. It wasn't as easy and it took him several days.

I don't think anyone would care though. I mean if you sold your M1 Mac mini to me or to most people, I think they wouldn't care. Even if you left everything on there and didn't format the disk. I wouldn't go to your personal files but I'd just reinstall the OS.

Years ago I bought a used Mac and they didnt format the hard drive. It was running OS X Lion and it signed in automatically. It had some apps on the dock and a different wallpaper and some files on the desktop, but I didn't care. I immediately restarted the laptop and went to disk utility, wiped the hard drive and reinstalled the OS and then after that was done I downloaded OS X Mavericks from the Mac App Store and installed it. I think most people would do what I did. I wouldn't care about your personal files at all.

Are you sure that isn’t because the FileVault encryption was registered to the person who was looking for the file on said computer? Or are you saying that a completely reformatted installation allowed a new person to crack the old encryption and get the word file?

 

[iHorseHead]

Are you sure that isn’t because the FileVault encryption was registered to the person who was looking for the file on said computer? Or are you saying that a completely reformatted installation allowed a new person to crack the old encryption and get the word file?

The Mac was even delisted from Addigy and the OS was reinstalled. It wasn't a personal Mac but a company's computer and the ticket went through several teams before it was recovered. The only instance where it was a personal computer in question I can think of is from 2013 and I'm sure a lot has changed during that time, but back then there were apps to recover the 'lost files'.

Still, if I was the OP I wouldn't worry about it.

 

[eltoslightfoot]

The Mac was even delisted from Addigy and the OS was reinstalled. It wasn't a personal Mac but a company's computer and the ticket went through several teams before it was recovered. The only instance where it was a personal computer in question I can think of is from 2013 and I'm sure a lot has changed during that time, but back then there were apps to recover the 'lost files'.

Still, if I was the OP I wouldn't worry about it.

That sounds like a very different situation. Thanks for clarifying.

 

[CharlesShaw]

Yes, was a mini M1 256GB

The screenshot above confirms that it is formatted?

My understanding (someone please correct me if I'm wrong and answer the OP's question) is that once you've set up and have been using a Mac with a T2 or M-series chip (like yours), the only way you can ever see the dialog box in your screenshot again is if you have gone into Settings > Transfer or Reset > Erase All Content and Settings. On Macs with those chips, you will have completed what Apple says is required prior to selling or trading-in the machine.

 

[shadowboi]

I think no one will bother doing this unless they know who you are and know that your info might be valuable (I doubt they do).

Protip: do not store data on Macs. Use removable flash and SSD drives for that. Keep the drives in a place where only you know. I specifically do not recommend cloud services for obvious reasons such as data availability and potential lack of encryption/protection

 

[CharlesShaw]

Protip: do not store data on Macs. Use removable flash and SSD drives for that. Keep the drives in a place where only you know. I specifically do not recommend cloud services for obvious reasons such as data availability and potential lack of encryption/protection

I have nothing to store on my Mac or other devices that isn't on iCloud, but they all get access to my keychain which gives them access to whatever passwords I've chosen not to memorize, most of which requires 2FA, so tell me, boi who lives in the shadows, does it really matter that I'm choosing convenience over security in this life we have in 2024? [edit: in case it wasn't clear, this is a serious question.]

 

[klasma]

My understanding (someone please correct me if I'm wrong and answer the OP's question) is that once you've set up and have been using a Mac with a T2 or M-series chip (like yours), the only way you can ever see the dialog box in your screenshot again is if you have gone into Settings > Transfer or Reset > Erase All Content and Settings. On Macs with those chips, you will have completed what Apple says is required prior to selling or trading-in the machine.

This. "Erase all contents and settings" erases the drive encryption key from the secure enclave, which makes it impossible to decrypt the drive contents. Macs that are lost/stolen and connected to iCloud can be remote-wiped.