macOS Monterey Allows You to Erase a Mac Without Needing to Reinstall the Operating System

[iApplereviews]

This is awesome news. So glad to see this. Will it replace using Configurator 2 on the M1 to restore / revive?

Great coverage on the new OS releases, MR. I appreciate the hard work.

No this only erases the data by destroying the encryption key stored in the T2. If you need to go back to a public update from the beta or do a full software restore you still need Configurator 2.

 

[cupcakes2000]

indeed

i certainly never claimed to be an expert on the subject

as i said, my interest in the feature had nothing to do with security

yet you did say this, which is what I responded to :

i wouldn’t consider this to be a security feature. you need to wipe a drive for that

To just say it again, No you dont, you can destroy the encryption key.

 

[mannyvel]

Yes. Almost anything can be possible theoretically, in some future where the tech or means to do the suggested act has been invented.

Encryption based ignorance is strong in this thread.

The assumption behind many types of encryption is that the amount of computing time necessary to break said encryption is an impossible barrier to overcome. That assumes an exhaustive search of the potential key space. The NSA has manipulated the standards process enough times that that assumption is probably invalid for most NIST-approved encryption algorithms, and possibly invalid for public-key encryption.

That said, it's probably good enough for the general public. Not everyone needs super-high security.

 

[nburwell]

This is great news, especially as I just purchased a M1 MBP and wiped and had to re-install Big Sur on the MBP I'm selling.

 

[SRQrws]

Please pardon my ignorance... Will this also automatically remove access to all the Application Support files and p-file stuff that's in the user's library? How about browsing history, email account info, etc.

 

[nathansz]

yet you did say this, which is what I responded to :


To just say it again, No you dont, you can destroy the encryption key.

i stand corrected

i suppose if the feature actually works as intended then perhaps one no longer needs to wipe the drive of an apple silicon computer in order to make the data inaccessible

better?

i’m still more curious about what data and settings it removes, ie: does it creates a completely fresh install faster and with fewer clicks and keystrokes than erasing the disk and reinstalling through a recovery volume or drive? for me that would be a much more interesting and useful feature

 

[cupcakes2000]

Please pardon my ignorance... Will this also automatically remove access to all the Application Support files and p-file stuff that's in the user's library? How about browsing history, email account info, etc.

Yes everything except the os

 

[ProfessionalFan]

Just tried this on my M1 13" MacBook Pro for all of you. It worked very well. Great process compared to the old way.

 

[TriBruin]

i stand corrected

i suppose if the feature actually works as intended then perhaps one no longer needs to wipe the drive of an apple silicon computer in order to make the data inaccessible

better?

i’m still more curious about what data and settings it removes, ie: does it creates a completely fresh install faster and with fewer clicks and keystrokes than erasing the disk and reinstalling through a recovery volume or drive? for me that would be a much more interesting and useful feature

It does not do a "fresh" install of the O/S. Since Big Sur was introduced, the O/S is on a sealed volume. After the installer completes its first install, it cryptographically signs the volume. When you boot, the system actually creates a copy of this SSV in RAM and then transfers the boot process to this copy. You are NEVER running on the original volume, just a ram based copy. When you shut down, it is destroyed.

All your data, preferences, etc, are stored on a second volume called "Macintosh - Data". Through some APFS magic, Apple presents the boot volume and data volume as a single volume to the user. If you want to see the actual volumes, open Disk Utility and select Show All Devices. You will see the various volumes listed under your internal drive.

This process deletes the data volume and recreates it. It does nothing on the system volume. It should be must faster than an actual delete and re-install.

 

[Apple_Robert]

No this only erases the data by destroying the encryption key stored in the T2. If you need to go back to a public update from the beta or do a full software restore you still need Configurator 2.

I wasn’t asking about backup. Configurator 2 isn’t a backup app. I was talking about in general not going back from beta.

 

[31 Flavas]

Insta-deleting all personal files seems very useful for certain criminals.

If an adversary wants to "insta-delete" your personal files - they don't need this "new" feature. Moreover, data destruction isn't very helpful to them - they can't ransom you for permanently deleted files.

Even still, it's been this way for iPhones for 10 years now. Have punks been pranking iPhone users for years by deleting their iPhones or iPads?

 

[OLC522]

Not clear how secure this is. When the system partition is updated are there mechanisms to prevent memory slack and, if not, to prevent memory slack turning into file slack on the signed volume? Note that this is a very high-end data leakage concern and it stems from my inability to locate info on how the OS works and not knowledge of a flaw. The average person or enterprise can absolutely rely on the user delete described by Apple. Does anyone know how memory and storage are handled?

 

[chucker23n1]

Not clear how secure this is.

It throws away the keys for your data partition. Perfectly secure.

When the system partition is updated are there mechanisms to prevent memory slack and, if not, to prevent memory slack turning into file slack on the signed volume? Note that this is a very high-end data leakage concern and it stems from my inability to locate info on how the OS works and not knowledge of a flaw. The average person or enterprise can absolutely rely on the user delete described by Apple. Does anyone know how memory and storage are handled?

I have no idea what you mean by "memory slack" or "file slack".

 

[ElRojito]

My IT guys are going to love this for redeployments

 

[zepfhyr]

This is a welcome feature. But I would still feel more secure reformatting the disk under recovery mode.

If you have FileVault enabled, you don't need to secure reformat (and you can't reliably secure reformat an SSD, anyway). Reformatting the drive will dump the encryption keys instead of decrypting the drive, making the data unrecoverable.

The real question is if Monterey encrypts the data partition automatically the same way iOS does so that FileVault becomes unnecessary.

 

[fivenotrump]

brilliant: Monterey is looking good

 

[chabig]

The real question is if Monterey encrypts the data partition automatically the same way iOS does so that FileVault becomes unnecessary.

On T2 and M1 Macs, storage is always encrypted, both with FileVault on and FileVault off. With Monterey, as with Big Sur, FileVault is beneficial.

...without enabling FileVault, a Mac merely has to be booted for the full-disk encryption to start working, even if it doesn’t automatically log into an account. While the encryption is locked to a hardware key managed by the Secure Enclave in the T2 chip, decryption kicks in as soon as the Mac boots to a login screen. A malicious party might be able to subvert macOS or use hardware methods to access data from the mounted and running drive.

Turn on FileVault, however, and a T2-equipped Mac engages in the same boot behavior as one that handles disk encryption in software. Instead of loading macOS directly, the Recovery partition boots in a special mode that requires entry of the password of any account allowed to use FileVault. Until that password is entered, the disk’s contents remain encrypted just as if it were at rest.

How FileVault and the T2 Security Chip work together in newer Macs

Macs with a T2 chip always encrypt their drives. Why is FileVault necessary?rn

www.macworld.com

 

[OLC522]

It throws away the keys for your data partition. Perfectly secure.



I have no idea what you mean by "memory slack" or "file slack".

Technologies, oversights, new discoveries, mistakes, design compromises, malfeasance, etc. all mean that reality rarely conforms to desires. As I said it is secure enough for almost all users and businesses but it is not perfectly secure in a broad sense, especially with regard to leakage outside the encrypted container. Slack is data that is in a unit of addressing but not expected to be addressed within some context. Perfectly clearing a key from effaceable storage even in a perfectly implemented crypto system still leaves other attack scenarios. I was asking if someone knows of anything about the Mac that mitigates those attack types.

 

[theorist9]

Nope. This new feature erases the data partition (actually, it just loses the decryption key, making it un-readable.) The Signed System Volume, is retained. Since no one can write to the SSV during normal operation, erasing the data partition is the same as clearing everything ever written. I haven't tested, but I assume, on reboot, the SSV is just recreating the basic Data volume with all the firm links.

What if the user gives an app permission to load kernel extensions? Some of the apps I use continue to require them (as these are not exotic apps, I would consider this part of normal operation). Aren't kexts installed into the OS kernel and thus into the Signed System Volume? And, if so, doesn't that mean this feature will not restore the OS to its factory state?

This is what signing is for. The system can determine if the SSV was altered and this feature will probably not work if you've altered it. Haven't tried it, but there's no point to signing the volume if you don't need to verify its integrity.

Sounds like your prediction is that, if kexts are installed into the SSV, this feature won't work.

Deployment Reference for Mac

This content has moved.

support.apple.com

 

[chabig]

I was asking if someone knows of anything about the Mac that mitigates those attack types.

macOS uses full disk encryption. Every byte on the SSD is encrypted. Slack is as encrypted the same as data.

All of your questions are addressed in Apple”s Platform Security Guide

Apple Platform Security

Learn how security is implemented in Apple hardware, software, apps, and services.

support.apple.com

 

[OLC522]

macOS uses full disk encryption. Every byte on the SSD is encrypted. Slack is as encrypted the same as data.

All of your questions are addressed in Apple”s Platform Security Guide

Apple Platform Security

Learn how security is implemented in Apple hardware, software, apps, and services.

support.apple.com

I’m familiar with the security guide but unfortunately it doesn’t provide that level of detail. This question deals with user memory data unintentionally retained in system partition slack. FDE would help if the device were wiped and no additional data written. It isn’t a prevention for what I asked about.

 

[donguevas]

This sounds great! I wanted to wipe my 2018 MBA to give it away, and ended up having to do an Internet Recovery, which took it all the way back to Mojave, and so then I had to create an account and upgrade back to Big Sur, and now I still can't seem to get it to be account-less so it goes through the welcome screens. A clean data wipe would be much easier.

You were in regular recovery. You can start up using Option-Command-R (instead of Command R, which brings you back to what originally came installed on the Mac) erase the drive with Disk Utility(both volumes, Macintosh HD, and HD Data) then when you reinstall it will be the latest and greatest and whoever turns it on next will get the set up assistant. Option Command and R takes you to whatever the newest the Mac can handle. https://support.apple.com/en-us/HT204904

 

[TriBruin]

What if the user gives an app permission to load kernel extensions? Some of the apps I use continue to require them (as these are not exotic apps, I would consider this part of normal operation). Aren't kexts installed into the OS kernel and thus into the Signed System Volume? And, if so, doesn't that mean this feature will not restore the OS to its factory state?

Sounds like your prediction is that, if kexts are installed into the SSV, this feature won't work.

They don’t have to be in the SSV to be loaded in the kernel. According to this pages, 3rd party KEXTs stored in `/Library/Extensions`, but 1st party extensions are stored in `/System/Library/Extensions`.

Extensions, Big Sur and M1 Macs

How to use kernel extensions, and their replacement system extensions, on Macs running Big Sur, including M1 Macs.

eclecticlight.co

 

[One2Grift]

Insta-deleting all personal files seems very useful for certain criminals.

Joking or just looking at it from a glib and narrow POV?

This is useful for anyone who cares about their privacy especially if: sell it, put it in someone else’s hands for an extended period, want/need to begin from a FR.

 

[chabig]

I’m familiar with the security guide but unfortunately it doesn’t provide that level of detail. This question deals with user memory data unintentionally retained in system partition slack. FDE would help if the device were wiped and no additional data written. It isn’t a prevention for what I asked about.

Why not? If every byte is encrypted, slack (if any) is also encrypted. Furthermore, nobody will be able t o tell what data is part of a file and what isn’t, since there will be no readable directory.