I sold my Mac mini last year and I'm scared

[opeter]

this is same reason i didnt sell my laptop a year or 2 ago. instead just gave it to my sis.

Did your sister find any adult material that would have put you or her in an uncomfortable situation?

 

[Superhai]

I really only remember that before selling I wanted to format it (obviously) and I remember going into recovery mode and seeing the utilities menu, then I remember waiting a long time for the Mac to install, and then the screenshot I posted came up.

I didn't delete that file you mention, so I understand that before I did the reinstall, I erased the disk, only now I don't remember exactly since it's been a year.

I also remember I followed a tutorial for that. (I'm a Windows user)

As many has pointed out the default option for macOS the last I think almost 10 years is that FileVault is on if you have T2 chip (and also M-series), but you can opt out. T2 and M-chips includes hardware AES-256 en–/decryption, so it is done without using any CPU, but initially after OS install it takes some time before everything is encrypted.

Maybe in 10 years or so it will start to be feasible to decrypt, but now it is not. (And if someone would have such a capability it will only be used for data that is really ultra valuable, if I had such a business I would have charged at least 6 figures $ per megabyte to recover). If you are some very special person, one might store the data for later, but I highly doubt that will happen. One thing to be aware of is that FileVault gives you two options, a decryption key you have to store locally, or one stored with your iCloud account. For the latter is if you chose to be able to use your iCloud account to decrypt your drive.

Formatting an encrypted drive is waste of time, and if you know that your data is very valuable you destroy the chips completely (physically). Remember also that SSD drives have internal logic, so writing zeros will not guarantee that is what will actually happen, it may just set the block to be garbage but data still present (this is not on the file system level, but controller level). And a big part of it are over-provisioned cache/reserved (not RAM but of the NAND chips), which the file system will not be able to touch.

Some drives support AES key crypto shredding, which just ensures that the private key of the encryption is not possible to use. As far as I understand the private key for internal Apple SSD is part of the Secure Enclave in T2 and M-series.

For magnetic hard drives, formatting by writing zeroes are not worth it. It is best illustrated if you ever tried to write silence to a magnetic audio tape, you can tell that it is not completely overwritten, because if you play it back you will still hear audio, but it is almost silent. So while it is much more noisy, "turning up" the volume on the HDD will eventually be able to bring some data back. The same with writing of random data, first time you can use the delta of the actual data and analyze the difference. It is because the magnetic particles need lots of power to align 100% to the direction you want. Several overwrite will eventually make it impossible to get the data back.

For private data, unless you do some rocket or nuclear science, I would not bother. If someone wants personal data, they will wait for some company is hacked and then leaked, or trick you through some social engineering or basic hacking. Exfiltrating data from drives is expensive, time-consuming and rarely worth the effort.

 

[chrfr]

As many has pointed out the default option for macOS the last I think almost 10 years is that FileVault is on if you have T2 chip (and also M-series), but you can opt out. T2 and M-chips includes hardware AES-256 en–/decryption, so it is done without using any CPU, but initially after OS install it takes some time before everything is encrypted.

No, as mentioned earlier in the thread, data on T2 and Apple Silicon Mac internal disks is always encrypted, even if the user has not enabled FileVault. There is no delay in encrypting when enabling FileVault because all the computer is doing is requiring a key to unlock that disk rather than the Secure Enclave unlocking it automatically.

 

[raythompsontn]

On a factory reset the encryption keys for the drive are changed. There is no way to retrieve the data on the SSD unless massive amounts of computing are thrown at the SSD. Your personal data is not that important. Move on with your life without fear.

 

[antiprotest]

Don't worry, be happy.

 

[Adora]

If someone is very motivated, they can recover some degree of data from a drive even if it has been formatted. For this reason, I don’t sell anything that includes the drive I used. I smash the drive to death with a hammer and recycle the remains. Yes, I’m on the bleeding edge of data security and I have zero regrets.

I did this hammer thing about 20-30 years ago with unencrypted HDDs that went in the trash. But mostly I just opened them and just kept the beautiful golden-colored disks inside.

10 years ago I got a used partly damaged Windows laptop and on the drive was very much private stuff even without a password. And bought some cheap damaged Macbooks for parts, what had all data on there disks. Without password I couldn't do anything and even If they were not encrypted I couldn't access the user folder from another Mac without the password. The Windows laptop someone send for free with a MacBook because she wanted to get rid of it.

I just had this iFixit kit new, what I mainly bought for iPhone battery change and then thought I could repair some old Macs. So I got some very good MacBook Pros for very cheap in 2014. But some were only for trash.

So for a standard buyer who doesn't but any effort in getting the data, mostly the password is already enough, if you sell a Mac with an undeleted/unformatted/unencrypted drive. What is not even approximately the case here.

 

[ChrisA]

Before selling it I remember that I formatted it,

By default, the data is encrypted. You can disable this but you'd remember doing it. So it simply does not matter one bit if you formatted the disk or not or if the data was overwritten. It is a non-issue.

 

[mkittyMarina]

The chances are low, don't worry.

 

[canadianreader]

I am already calm.



Worse is when last year I went to a cyber and logged in with my Google account. Nothing happened either.



Bad paranoia, it doesn't let me live.



I wish I had known about all this security stuff.

Your paranoia is healthy and prevents you from making mistakes in the future. Hopefully nothing will happen but next time use filevault to encrypt your drive and encrypt time machine as well.

 

[AlixSPQR]

No, it doesn't encrypt again. It only encrypts the key and only takes seconds for it to turn on for T2 / Apple Silicon Macs (compared to before, when it took time to encrypt the entire drive). With the key being encrypted, it adds an additional layer of security by requiring the password to decrypt the key, which is then used to decrypt your data.

Thank you. How does this additional layer of security play in, when it comes to restoring data, which is already encrypted? Is it another password than the log in password or iCloud password?

 

[MacCheetah3]

Foremost, the nature of how SSDs function, namely TRIM and wear leveling, makes data recovery far more difficult.

Data Recovery on SSD is more difficult than HDD

Mention SSDs and HDDs together and its bound to lead to transfer speeds, IOPS, power consumption, and the impending demise of HDDs. However, this article takes a different route—it's not about SSD vs. HDD; it's about data recoverability. Undeleting data from a working HDD is easier than...

www.thestorageguy.net

Why SSD is a challenge for forensic analysis? - Darwin's Data

The TRIM command was introduced for SSDs to help maintain performance over time. When a file is deleted on an SSD, the operating system informs the SSD which

darwinsdata.com

But yes… Apple has added several more blocks.

Disk encryption, FileVault and hardware encryption

What is FileVault encryption? Is it the same as that on an M1 Mac’s internal SSD, or something different? How can you use it instead of overwriting an SSD? Which boot volumes are encrypted?

eclecticlight.co

This. "Erase all contents and settings" erases the drive encryption key from the secure enclave, which makes it impossible to decrypt the drive contents. Macs that are lost/stolen and connected to iCloud can be remote-wiped.

Correct, basically, Erase All Content and Settings deletes the “Data” volume, which houses the user (accounts) data. As part of that removal process:

When deleting a volume, its volume encryption key is securely deleted by the Secure Enclave. This helps prevent future access with this key even by the Secure Enclave. In addition, all volume encryption keys are wrapped with a media key. The media key doesn’t provide additional confidentiality of data; instead, it’s designed to enable swift and secure deletion of data because without it decryption is impossible.

Volume encryption with FileVault in macOS

In Mac OS X 10.3 or later, Mac computers provide FileVault, a built-in encryption capability to secure all data at rest.

support.apple.com

Explainer: xART and nonces

A strange volume named xART or xarts, secure memory management, and long random numbers: how they fit together to protect against replay attacks.

eclecticlight.co

Also:

If FileVault isn’t turned on in a Mac with Apple silicon or a Mac with the T2 chip during the initial Setup Assistant process, the volume is still encrypted but the volume encryption key is protected only by the hardware UID in the Secure Enclave.

And the UID:

The Secure Enclave includes a unique ID (UID) root cryptographic key. The UID is unique to each individual device and isn’t related to any other identifier on the device.

A randomly generated UID is fused into the SoC at manufacturing time. Starting with A9 SoCs, the UID is generated by the Secure Enclave TRNG during manufacturing and written to the fuses using a software process that runs entirely in the Secure Enclave. This process protects the UID from being visible outside the device during manufacturing and therefore isn’t available for access or storage by Apple or any of its suppliers.

Secure Enclave

The Secure Enclave is a dedicated secure subsystem in the latest versions of iPhone, iPad, Mac, Apple TV, Apple Watch, Apple Vision Pro, and HomePod.

support.apple.com

One major concern was when an iPad died, I took it in to the Apple Store, they confirmed it was toast and offered a replacement via applecare. But as mr Geniusman is taking the dead one, I ask him if there's ANY chance that SSD gets disassembled in China and its contents looked at. He replies "probably not", and I'm like yea but if you're wrong, I am absolutely going to prison. At this point I have to explain what ITAR is because the look on their faces tells me they're alarmed that I'm the worst kind of pervert. I asked if there was a way we can ensure the dead ipad is processed without ever leaving the US, and they just taped a little note on it that said "USA" to get me out of there lol. I walked out feeling somewhat relieved they only thought of me as a sex offender instead of as a guy who worked on those kind of weapons, a realization that led to the end of that kind of work.

sepOS uses the UID to protect device-specific secrets. The UID allows data to be cryptographically tied to a particular device. For example, the key hierarchy protecting the file system includes the UID, so if the internal SSD storage is physically moved from one device to another, the files are inaccessible.

Is File Vault removed from Si Macs, since the data is encrypted anyway?

It's still there and I just saw it is even disabled, but my drive is formatted APFS (encrypted). Must be because I am using an external drive that was formatted encrypted before. On my MBP with internal boot drive it's turned on and I can't remember doing that on purpose.


When I turn it on, there are those options, but I don't think it will encrypt the whole 2.2TB data again.

Enabling FileVault doesn’t re-encrypt the volume. Instead, it rewraps the (“Data”) volume encryption key (VEK) with a new media key generated also on the account password.

Ultimately:

If some one is going to invest time and money going lengths to recover encryption keys, if it is even possible. And then decrypt, the target has to be high value. If you are high value target, mac encryption is least of your problems.

Nowadays… Social engineering is much more effective (and thus far more popular).

 

[CharlesShaw]

Foremost, the nature of how SSDs function ...

This is what I imagine it's like to get your draft thesis back from a generous advisor.

 

[philipma1957]

I own lots of Mac’s. Including Mac minis. I never ever use the internal drives for security reasons. I simply use external Samsung t-9 t-7 t-5 ssds. So the internal is base size the ram is high. I save money. And when I sell a mini the internal has basically no info of mine. Problem solved. I used clone of the internal with shirt-pocket clone software.
I have two external clones. I have an external Time Machine. Very easy way to run a Mac. Also I need 2tb ssd and apples price for that is stupid. Superduper works on 2018 mini and an m1 and a m2 I am ready to replace the 2018 but I am not sure the new m4 will clone for me using superduper.

 

[ThailandToo]

There is zero reason to worry about this. For one, it’s done. Nothing you can do now. Second reason is Apple is pretty good at data encryption. Third reason is it’s doubtful anyone you sold it to would use to scour your data. Most likely your data has been gone for some time due to formatting and other data overwriting it. The only reason to worry is when you’re selling to ensure you have done all you can.

I work with clients sensitive financial data, and I have never thought twice about this as I encrypt and protect every drive in Mac with the security key and don’t let it be recovered by iCloud. Far more likely some cloud services have given up your data than selling an old device online.

May you find inner peace and not let past decisions bother you. Cheers.

 

[Chuckeee]

this is same reason i didnt sell my laptop a year or 2 ago. instead just gave it to my sis.

Depends, How much do you really trust your sister?

😁

 

[Populus]

Depends, How much do you really trust your sister?

😁

His sister:

 

[adib]

That sounds like a very different situation. Thanks for clarifying.

The Mac was even delisted from Addigy and the OS was reinstalled. It wasn't a personal Mac but a company's computer and the ticket went through several teams before it was recovered. The only instance where it was a personal computer in question I can think of is from 2013 and I'm sure a lot has changed during that time, but back then there were apps to recover the 'lost files'.

Still, if I was the OP I wouldn't worry about it.

A company computer would likely have the drive's decryption keys stored by the company and cloud backups also accessible by the company.

 

[eltoslightfoot]

A company computer would likely have the drive's decryption keys stored by the company and cloud backups also accessible by the company.

Exactly. It's a different situation.

 

[NewOldStock]

Man can't even sell swamp land around here to scare the nerds! lol

But yes M1`s and newer no go on recovery with erase function to re-sell your computer.

 

[surfbutler]

I think the chances of you selling your Mac to someone with these "special programs" is ridiculously low, unless you live in a hotbed of cybercrime or right next door to a spy agency or something.

Though hopefully you wouldn't ever know that you lived next door to a spy agency.

 

[cyanite]

But now that I've been trained in security and I've seen that the best thing to do is to overwrite the left space data

Not really possible or a good idea on an SSD. And not relevant to newer Macs anyway.

I've read that if it's an Apple ssd, the Trim feature fills the empty space with zeros, so there wouldn't be a problem, but I CAN'T CONFIRM IT, I've read it here:

To write non-zero values to a block, the entire block must be zeroed out. It doesn't always happen right away. Trim just tells the drive it can do it. But it's not relevant to newer Macs.

Your data was encrypted. At least that's standard setting for some years now

Even if FileVault is turned off, the disk is encrypted.

But it's still possible to recover the data on the disk even after formatting it and reinstalling the OS

It isn't once the Mac has been wiped with the option intended to do that.

If FileVault is not enabled they can create a new admin account / change the password and through that they could reset the user password as well.

Not possible once the Mac is wiped, since the keys are lost.

Theoretically if some one can recover your encryption keys and then decrypt the drive to recover. After T2 chips and Apple silicon, it’s probably not something you can do it in practice. It’s not impossible but very hard to do.

It's impossible in most practical sense

When I turn it on, there are those options, but I don't think it will encrypt the whole 2.2TB data again.

It just re-encrypts the underlying real encryption key.

 

[Trusteft]

Just remove the drive if you are so afraid some important data might get into someone else's hands. Sell the rest of the computer without the drive, or replace the drive with a budget alternative.
Problem solved.

 

[cyanite]

I never ever use the internal drives for security reasons

Your internal drive is overall vastly more secure than your external ones, but whatever you like.

 

[ignatius345]

Before selling it I remember that I formatted it, (I have a screenshot I had taken, I hope that's what it is)

But now that I've been trained in security and I've seen that the best thing to do is to overwrite the left space data, I've become paranoid and I don't want to sell any more equipment, but I've already sold it and I'm afraid that someone might recover the data with special programs. (I had work documentation)

As others have pointed out, the odds of that are super low. Even disregarding for a moment the Secure Enclave and FileVault encryption, remember also that every moment the machine is on and running decreases the (already remote) possibility of anything being recovered from it. Why? Because stuff is constantly being written to disk, overwriting any latent deleted data. That could happen with cache files or virtual memory, all stuff generated in the course of normal operation.

When IT forensic investigators go to recover stuff of a machine, they absolutely do NOT run it in any way. They isolate the storage drive from the volatility of the device its installed in, then use special tools to clone it bit by bit to another drive where they can try extract data.

 

[HowEver]

this is same reason i didnt sell my laptop a year or 2 ago. instead just gave it to my sis.

It's a good thing family members never sell or regift computers?