Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #50002 > unrolled thread

Selling iMac - Securing the disk

Back to article view | Back to comp.sys.mac.system

Contents

  Selling iMac - Securing the disk Alan Browne <alan.browne@FreelunchVideotron.ca> - 2013-10-15 15:50 -0400
    Re: Selling iMac - Securing the disk billy@MIX.COM - 2013-10-15 22:49 +0000
      Re: Selling iMac - Securing the disk George Kerby <ghost_topper@hotmail.com> - 2013-10-15 18:00 -0500
      Re: Selling iMac - Securing the disk Your Name <YourName@YourISP.com> - 2013-10-16 13:34 +1300
      Re: Selling iMac - Securing the disk Alan Browne <alan.browne@FreelunchVideotron.ca> - 2013-10-17 17:54 -0400
        Re: Selling iMac - Securing the disk JF Mezei <jfmezei.spamnot@vaxination.ca> - 2013-10-17 18:31 -0400
          Re: Selling iMac - Securing the disk Alan Browne <alan.browne@FreelunchVideotron.ca> - 2013-10-17 19:57 -0400
            Re: Selling iMac - Securing the disk dempson@actrix.gen.nz (David Empson) - 2013-10-18 13:03 +1300
              Re: Selling iMac - Securing the disk Alan Browne <alan.browne@FreelunchVideotron.ca> - 2013-10-17 20:51 -0400
            Re: Selling iMac - Securing the disk nospam <nospam@nospam.invalid> - 2013-10-17 20:53 -0400
          Re: Selling iMac - Securing the disk nospam <nospam@nospam.invalid> - 2013-10-17 20:53 -0400
            Re: Selling iMac - Securing the disk JF Mezei <jfmezei.spamnot@vaxination.ca> - 2013-10-18 00:27 -0400
              Re: Selling iMac - Securing the disk nospam <nospam@nospam.invalid> - 2013-10-18 03:09 -0400
        Re: Selling iMac - Securing the disk dempson@actrix.gen.nz (David Empson) - 2013-10-18 12:30 +1300
          Re: Selling iMac - Securing the disk Alan Browne <alan.browne@FreelunchVideotron.ca> - 2013-10-17 20:03 -0400
          Re: Selling iMac - Securing the disk nospam <nospam@nospam.invalid> - 2013-10-17 20:53 -0400
            Re: Selling iMac - Securing the disk dempson@actrix.gen.nz (David Empson) - 2013-10-18 16:01 +1300
              Re: Selling iMac - Securing the disk nospam <nospam@nospam.invalid> - 2013-10-17 23:42 -0400
        Re: Selling iMac - Securing the disk Erik <spam@this.com> - 2013-10-17 17:27 -0700
          Re: Selling iMac - Securing the disk Alan Browne <alan.browne@FreelunchVideotron.ca> - 2013-10-17 20:50 -0400
        Re: Selling iMac - Securing the disk nospam <nospam@nospam.invalid> - 2013-10-17 20:53 -0400
    Re: Selling iMac - Securing the disk Erik <spam@this.com> - 2013-10-15 18:59 -0700
      Re: Selling iMac - Securing the disk jamiekg@wizardling.geek.nz (Jamie Kahn Genet) - 2013-10-16 15:33 +1300
        Re: Selling iMac - Securing the disk George Kerby <ghost_topper@hotmail.com> - 2013-10-18 13:08 -0500
          Re: Selling iMac - Securing the disk Erik <spam@this.com> - 2013-10-18 12:06 -0700
            Re: Selling iMac - Securing the disk Your Name <YourName@YourISP.com> - 2013-10-19 10:17 +1300

Page 1 of 2  [1] 2  Next page →

#50002 — Selling iMac - Securing the disk

So I'm selling my older iMac.

Filevault 2 is on.

    So if I
	delete all the files
    	Remove the account
    	Turn off filevault2

Then I assume the files are practically unrecoverable (I'll destroy the 
recovery key as well, naturally...).



-- 
"Political correctness is a doctrine, fostered by a delusional,
illogical minority, and rapidly promoted by mainstream media,
which holds forth the proposition that it is entirely possible
to pick up a piece of shit by the clean end."
                                                  -Unknown

[toc] | [next] | [standalone]

#50014

Alan Browne <alan.browne@freelunchvideotron.ca> writes:

> So I'm selling my older iMac.
> 
> Filevault 2 is on.
> 
>     So if I
>         delete all the files
>         Remove the account
>         Turn off filevault2
> 
> Then I assume the files are practically unrecoverable (I'll destroy the 
> recovery key as well, naturally...).

If I was selling a computer with is disks, I'd zero them out
and then reinstall the operating system, thus giving the new
owner a clean system to mess up as she/he sees fit.  Or, this
is what I've done when I've bought used computers...

Billy Y..
-- 
        sub     #'9+1   ,r0             ; convert ascii byte
	add     #9.+1   ,r0             ; to an integer
	bcc     20$                     ; not a number

[toc] | [prev] | [next] | [standalone]

#50015

On 10/15/13 5:49 PM, in article l3kgqn$f92$1@reader1.panix.com,
"billy@MIX.COM" <billy@MIX.COM> wrote:

> Alan Browne <alan.browne@freelunchvideotron.ca> writes:
> 
>> So I'm selling my older iMac.
>> 
>> Filevault 2 is on.
>> 
>>     So if I
>>         delete all the files
>>         Remove the account
>>         Turn off filevault2
>> 
>> Then I assume the files are practically unrecoverable (I'll destroy the
>> recovery key as well, naturally...).
> 
> If I was selling a computer with is disks, I'd zero them out
> and then reinstall the operating system, thus giving the new
> owner a clean system to mess up as she/he sees fit.  Or, this
> is what I've done when I've bought used computers...
> 
> Billy Y..

Sounds like a lot less trouble.

[toc] | [prev] | [next] | [standalone]

#50020

In article <l3kgqn$f92$1@reader1.panix.com>, <billy@MIX.COM> wrote:
> Alan Browne <alan.browne@freelunchvideotron.ca> writes:
> 
> > So I'm selling my older iMac.
> > 
> > Filevault 2 is on.
> > 
> >     So if I
> >         delete all the files
> >         Remove the account
> >         Turn off filevault2
> > 
> > Then I assume the files are practically unrecoverable (I'll destroy the 
> > recovery key as well, naturally...).
> 
> If I was selling a computer with is disks, I'd zero them out
> and then reinstall the operating system, thus giving the new
> owner a clean system to mess up as she/he sees fit.  Or, this
> is what I've done when I've bought used computers...

It might even be better to not even bother re-installing the OS. Let
them do it from the (original install discs if applicable) with their
own chosen account name and password.

[toc] | [prev] | [next] | [standalone]

#50126

On 2013.10.15 18:49 , billy@MIX.COM wrote:
> Alan Browne <alan.browne@freelunchvideotron.ca> writes:
>
>> So I'm selling my older iMac.
>>
>> Filevault 2 is on.
>>
>>      So if I
>>          delete all the files
>>          Remove the account
>>          Turn off filevault2
>>
>> Then I assume the files are practically unrecoverable (I'll destroy the
>> recovery key as well, naturally...).
>
> If I was selling a computer with is disks, I'd zero them out
> and then reinstall the operating system, thus giving the new
> owner a clean system to mess up as she/he sees fit.  Or, this
> is what I've done when I've bought used computers...

In the end that's what I did.

Even though I 'deleted' all my personal files, when I went to do a clean 
install with a reformatted drive I could not "erase" it in Disk Utility 
while it was in FileVault2 status.

So I took it out of FV2 status and it promptly decrypted what I assume 
is the entire drive - it took about 12 hours.  So it seems it decrypted 
every sector on the disk and therefore private data (though "deleted") 
is potentially exposed to anyone who wants to really sniff.

So, I re-installed the OS on the freshly formatted drive and I'm running 
"Erase Free Space" (simplest/fastest which I assume is probably just 
0's) to be sure the disk is clean of all my dirty secrets.

Or more importantly, the clean ones.

-- 
"Quotation, n: The act of repeating erroneously the words of another."
                                                 -Ambrose Bierce

[toc] | [prev] | [next] | [standalone]

#50128

On 13-10-17 17:54, Alan Browne wrote:

> So I took it out of FV2 status and it promptly decrypted what I assume 
> is the entire drive - it took about 12 hours. 


It's interesting that the functionality of true formating of a disk
drive was taken out and rarely seen anymore.  Perhaps because it now
takes too long to format disks that are so big.

I am surprised that Disk Utility wouldn't let you zap a filevault drive.
Did you try to click on the physical device instead of the volume ?

I suspect line command tools would have had options to zap contents
without having to first decrypt the drive.

And if you had deleted all files from the drive, I would have thought
that decryoption would have beeen quite fast since it would have only
been the disk/volume headers that needed to be decrypted.

[toc] | [prev] | [next] | [standalone]

#50133

On 2013.10.17 18:31 , JF Mezei wrote:
> On 13-10-17 17:54, Alan Browne wrote:
>
>> So I took it out of FV2 status and it promptly decrypted what I assume
>> is the entire drive - it took about 12 hours.
>
>
> It's interesting that the functionality of true formating of a disk
> drive was taken out and rarely seen anymore.  Perhaps because it now
> takes too long to format disks that are so big.
>
> I am surprised that Disk Utility wouldn't let you zap a filevault drive.
> Did you try to click on the physical device instead of the volume ?

Believe me I was very intent on erasing the volume - it would not 
provide an active erase button.  I researched around the web and could 
not find anything definite so I resorted to deactivating FV2.

As I did that I realized that any prior deleted files would be decrypted 
unless it only decrypted non-deleted files.

Since it took 12 hours I really have no idea what it really did, so when 
finished (late last night) I re-intalled ML and then ran the Erase Empty 
Space.  Just re-booted after the 10.8.5 Combo - ah shucks - got to add 
the supplemental too, I guess....

> I suspect line command tools would have had options to zap contents
> without having to first decrypt the drive.
>
> And if you had deleted all files from the drive, I would have thought
> that decryoption would have beeen quite fast since it would have only
> been the disk/volume headers that needed to be decrypted.

Not even that really.  If the keys are lost then everything encrypted 
should be lost.  So I'd be happy if when de-activating FV2 it simply:

	- decrypt everything that was still not-deleted
	- deactivate FV2
	- shred the keys

That would be enough.

-- 
"Quotation, n: The act of repeating erroneously the words of another."
                                                 -Ambrose Bierce

[toc] | [prev] | [next] | [standalone]

#50134

Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:

[...]

> Just re-booted after the 10.8.5 Combo - ah shucks - got to add the
> supplemental too, I guess....

Not if you downloaded that 10.8.5 Combo after 3 October, or used
Software Update (App Store) to install it. Apple revised the 10.8.5
delta and combo updaters when they released the supplemental update.

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#50140

On 2013.10.17 20:03 , David Empson wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>
> [...]
>
>> Just re-booted after the 10.8.5 Combo - ah shucks - got to add the
>> supplemental too, I guess....
>
> Not if you downloaded that 10.8.5 Combo after 3 October, or used
> Software Update (App Store) to install it. Apple revised the 10.8.5
> delta and combo updaters when they released the supplemental update.

Darn.  Well - done and done.  The combo was not that large anyway.


-- 
"Quotation, n: The act of repeating erroneously the words of another."
                                                 -Ambrose Bierce

[toc] | [prev] | [next] | [standalone]

#50145

In article <v82dnazqsprp5P3PnZ2dnUVZ_r-dnZ2d@giganews.com>, Alan Browne
<alan.browne@FreelunchVideotron.ca> wrote:

> > I am surprised that Disk Utility wouldn't let you zap a filevault drive.
> > Did you try to click on the physical device instead of the volume ?
> 
> Believe me I was very intent on erasing the volume - it would not 
> provide an active erase button.  I researched around the web and could 
> not find anything definite so I resorted to deactivating FV2.

first hit on google for how to erase a file vault drive:
<https://discussions.apple.com/thread/4269942>

[toc] | [prev] | [next] | [standalone]

#50144

In article <5260654f$0$10189$c3e8da3$9b4ff22a@news.astraweb.com>, JF
Mezei <jfmezei.spamnot@vaxination.ca> wrote:

> On 13-10-17 17:54, Alan Browne wrote:
> 
> > So I took it out of FV2 status and it promptly decrypted what I assume 
> > is the entire drive - it took about 12 hours. 
> 
> 
> It's interesting that the functionality of true formating of a disk
> drive was taken out and rarely seen anymore.  Perhaps because it now
> takes too long to format disks that are so big.

it was never taken out.

formatting has always meant wiping the directory. 

'low level' formatting is a misused term and done at the factory (and
can only be done at the factory). what people call low level formatting
is zeroing all sectors.

there is no way to low level format a drive outside of the factory. the
commands to do so are not there. 

> I am surprised that Disk Utility wouldn't let you zap a filevault drive.
> Did you try to click on the physical device instead of the volume ?

why are you surprised?

if it let you do that, people would be formatting encrypted drives
because they aren't readable without the key.

> I suspect line command tools would have had options to zap contents
> without having to first decrypt the drive.

they do. someone who knows enough to do it via the command line should
know what they're doing.

> And if you had deleted all files from the drive, I would have thought
> that decryoption would have beeen quite fast since it would have only
> been the disk/volume headers that needed to be decrypted.

the encryption is not file based and the number of files do not matter.

[toc] | [prev] | [next] | [standalone]

#50157

On 13-10-17 20:53, nospam wrote:

> formatting has always meant wiping the directory. 

nop.


> 'low level' formatting is a misused term and done at the factory (and
> can only be done at the factory). what people call low level formatting
> is zeroing all sectors.

> there is no way to low level format a drive outside of the factory. the
> commands to do so are not there. 

Not for ATA and SATA. But I believe SCSI still have it. I have low level
formatted SCSI drives in the past.  I have also done pre-SCSI low level
formats (DSSI drives, MFM drives from DEC).

The command might still be there, but not supported by drivers anymore.



> if it let you do that, people would be formatting encrypted drives
> because they aren't readable without the key.

fine, so you check that you have the password for the encrypted drive
and if you do, it lets you zap the contents.

[toc] | [prev] | [next] | [standalone]

#50160

In article <5260b898$0$17095$c3e8da3$dd9697d2@news.astraweb.com>, JF
Mezei <jfmezei.spamnot@vaxination.ca> wrote:

> > formatting has always meant wiping the directory. 
> 
> nop.

yes it has.

> > 'low level' formatting is a misused term and done at the factory (and
> > can only be done at the factory). what people call low level formatting
> > is zeroing all sectors.
> 
> > there is no way to low level format a drive outside of the factory. the
> > commands to do so are not there. 
> 
> Not for ATA and SATA.

which is the drive in question

> But I believe SCSI still have it.

macs haven't used scsi in ages.

> I have low level
> formatted SCSI drives in the past.  I have also done pre-SCSI low level
> formats (DSSI drives, MFM drives from DEC).
> 
> The command might still be there, but not supported by drivers anymore.

that is also possible.
 
> > if it let you do that, people would be formatting encrypted drives
> > because they aren't readable without the key.
> 
> fine, so you check that you have the password for the encrypted drive
> and if you do, it lets you zap the contents.

that could work.

[toc] | [prev] | [next] | [standalone]

#50131

Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:

> On 2013.10.15 18:49 , billy@MIX.COM wrote:
> > Alan Browne <alan.browne@freelunchvideotron.ca> writes:
> >
> >> So I'm selling my older iMac.
> >>
> >> Filevault 2 is on.
> >>
> >>      So if I
> >>          delete all the files
> >>          Remove the account
> >>          Turn off filevault2
> >>
> >> Then I assume the files are practically unrecoverable (I'll destroy the
> >> recovery key as well, naturally...).
> >
> > If I was selling a computer with is disks, I'd zero them out
> > and then reinstall the operating system, thus giving the new
> > owner a clean system to mess up as she/he sees fit.  Or, this
> > is what I've done when I've bought used computers...
> 
> In the end that's what I did.
> 
> Even though I 'deleted' all my personal files, when I went to do a clean
> install with a reformatted drive I could not "erase" it in Disk Utility
> while it was in FileVault2 status.

Where did you boot from to run that copy of Disk Utility, was it a
Mountain Lion version of Disk Utility, and did you try to erase just the
main partition or the entire drive?

I haven't played with FV2 yet, but from reading about it on Apple's web
site, in theory you should be able to start up from the recovery
partition (with Command-R), and in there, you should be able to erase
the FV2 protected main partition without having to deprotect it.

I'd also expect that if you booted Mountain Lion from a different drive,
Disk Utility could erase the entire drive.

> So I took it out of FV2 status and it promptly decrypted what I assume
> is the entire drive - it took about 12 hours.  So it seems it decrypted
> every sector on the disk and therefore private data (though "deleted")
> is potentially exposed to anyone who wants to really sniff.

That would be a problem for an SSD, since Mac OS X doesn't even offer
the secure options when erasing an SSD. Apple claims that a normal erase
would make data on the SSD "difficult to recover".

They also suggest using FV2 as a better way to protect data on an SSD.
Having to disable FV2 to erase the drive would be counterproductive.

http://support.apple.com/kb/HT3680

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#50135

On 2013.10.17 19:30 , David Empson wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>
>> On 2013.10.15 18:49 , billy@MIX.COM wrote:
>>> Alan Browne <alan.browne@freelunchvideotron.ca> writes:
>>>
>>>> So I'm selling my older iMac.
>>>>
>>>> Filevault 2 is on.
>>>>
>>>>       So if I
>>>>           delete all the files
>>>>           Remove the account
>>>>           Turn off filevault2
>>>>
>>>> Then I assume the files are practically unrecoverable (I'll destroy the
>>>> recovery key as well, naturally...).
>>>
>>> If I was selling a computer with is disks, I'd zero them out
>>> and then reinstall the operating system, thus giving the new
>>> owner a clean system to mess up as she/he sees fit.  Or, this
>>> is what I've done when I've bought used computers...
>>
>> In the end that's what I did.
>>
>> Even though I 'deleted' all my personal files, when I went to do a clean
>> install with a reformatted drive I could not "erase" it in Disk Utility
>> while it was in FileVault2 status.
>
> Where did you boot from to run that copy of Disk Utility, was it a
> Mountain Lion version of Disk Utility, and did you try to erase just the
> main partition or the entire drive?

I made a boot image for ML on a CF card in a card reader (USB) and 
booted that using 'option' (and CMD-R) on restart on several attempts. 
  Selected that card to boot from.

> I haven't played with FV2 yet, but from reading about it on Apple's web
> site, in theory you should be able to start up from the recovery
> partition (with Command-R), and in there, you should be able to erase
> the FV2 protected main partition without having to deprotect it.

In one of my attempts I booted with CMD-R but had the same issue

> I'd also expect that if you booted Mountain Lion from a different drive,
> Disk Utility could erase the entire drive.

Any drive but the one to be erased (I believe).

>
>> So I took it out of FV2 status and it promptly decrypted what I assume
>> is the entire drive - it took about 12 hours.  So it seems it decrypted
>> every sector on the disk and therefore private data (though "deleted")
>> is potentially exposed to anyone who wants to really sniff.
>
> That would be a problem for an SSD, since Mac OS X doesn't even offer
> the secure options when erasing an SSD. Apple claims that a normal erase
> would make data on the SSD "difficult to recover".
>
> They also suggest using FV2 as a better way to protect data on an SSD.
> Having to disable FV2 to erase the drive would be counterproductive.
>
> http://support.apple.com/kb/HT3680

Well - whatever - something didn't go the way it was designed.  I tried 
several times (3 or 4) before giving up and de-setting FV2 which in turn 
caused me to do a full free space erase after re-intalling.

Did I screw up somewhere?  Very possible - but that's water below the 
dam now.


-- 
"Quotation, n: The act of repeating erroneously the words of another."
                                                 -Ambrose Bierce

[toc] | [prev] | [next] | [standalone]

#50146

In article <1laxr3l.ndjmt18gh9qgN%dempson@actrix.gen.nz>, David Empson
<dempson@actrix.gen.nz> wrote:

> > So I took it out of FV2 status and it promptly decrypted what I assume
> > is the entire drive - it took about 12 hours.  So it seems it decrypted
> > every sector on the disk and therefore private data (though "deleted")
> > is potentially exposed to anyone who wants to really sniff.
> 
> That would be a problem for an SSD, since Mac OS X doesn't even offer
> the secure options when erasing an SSD. Apple claims that a normal erase
> would make data on the SSD "difficult to recover".

it may be 'difficult' for the average person, but it's not impossible.

due to wear leveling, there will always be unencrypted data somewhere
on the ssd. 

> They also suggest using FV2 as a better way to protect data on an SSD.
> Having to disable FV2 to erase the drive would be counterproductive.

that is correct.

> http://support.apple.com/kb/HT3680

404

[toc] | [prev] | [next] | [standalone]

#50154

nospam <nospam@nospam.invalid> wrote:

> In article <1laxr3l.ndjmt18gh9qgN%dempson@actrix.gen.nz>, David Empson
> <dempson@actrix.gen.nz> wrote:
> 
> > > So I took it out of FV2 status and it promptly decrypted what I assume
> > > is the entire drive - it took about 12 hours.  So it seems it decrypted
> > > every sector on the disk and therefore private data (though "deleted")
> > > is potentially exposed to anyone who wants to really sniff.
> > 
> > That would be a problem for an SSD, since Mac OS X doesn't even offer
> > the secure options when erasing an SSD. Apple claims that a normal erase
> > would make data on the SSD "difficult to recover".
> 
> it may be 'difficult' for the average person, but it's not impossible.

Indeed.

> due to wear leveling, there will always be unencrypted data somewhere
> on the ssd. 
> 
> > They also suggest using FV2 as a better way to protect data on an SSD.
> > Having to disable FV2 to erase the drive would be counterproductive.
> 
> that is correct.
> 
> > http://support.apple.com/kb/HT3680
> 
> 404

Works fine for me. Apple's knowledge base has been known to randomly
produce 404 errors from time to time, or there could be a distribution
issue with Akamai. Try again.

The title is

"Mac OS X: About Disk Utility's erase free space feature"

It documents exactly what the zero data, 7-pass and 35-erase options do,
and has the following note at the end:

"Note: With OS X Lion and an SSD drive, Secure Erase and Erasing Free
Space are not available in Disk Utility. These options are not needed
for an SSD drive because a standard erase makes it difficult to recover
data from an SSD. For more security, consider turning on FileVault 2
encryption when you start using the SSD drive."

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#50155

In article <1laxx10.cq5z5q7pe4hdN%dempson@actrix.gen.nz>, David Empson
<dempson@actrix.gen.nz> wrote:

> > > They also suggest using FV2 as a better way to protect data on an SSD.
> > > Having to disable FV2 to erase the drive would be counterproductive.
> > 
> > that is correct.
> > 
> > > http://support.apple.com/kb/HT3680
> > 
> > 404
> 
> Works fine for me. Apple's knowledge base has been known to randomly
> produce 404 errors from time to time, or there could be a distribution
> issue with Akamai. Try again.

weird. now it works.

> The title is
> 
> "Mac OS X: About Disk Utility's erase free space feature"
> 
> It documents exactly what the zero data, 7-pass and 35-erase options do,
> and has the following note at the end:
> 
> "Note: With OS X Lion and an SSD drive, Secure Erase and Erasing Free
> Space are not available in Disk Utility. These options are not needed
> for an SSD drive because a standard erase makes it difficult to recover
> data from an SSD. For more security, consider turning on FileVault 2
> encryption when you start using the SSD drive."

7 pass and certainly 35 pass is incredibly stupid on an ssd.

however, the point remains that you can't ever completely erase an ssd
due to wear leveling. 

if you plan on storing information that would ultimately need to be
erased, it *must* be encrypted, or some portion of it will still be in
spare blocks, somewhere on the ssd.

[toc] | [prev] | [next] | [standalone]

#50137

In article <YcydnfJJIYkKwf3PnZ2dnUVZ_rqdnZ2d@giganews.com>,
 Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:

> On 2013.10.15 18:49 , billy@MIX.COM wrote:
> > Alan Browne <alan.browne@freelunchvideotron.ca> writes:
> >
> >> So I'm selling my older iMac.
> >>
> >> Filevault 2 is on.
> >>
> >>      So if I
> >>          delete all the files
> >>          Remove the account
> >>          Turn off filevault2
> >>
> >> Then I assume the files are practically unrecoverable (I'll destroy the
> >> recovery key as well, naturally...).
> >
> > If I was selling a computer with is disks, I'd zero them out
> > and then reinstall the operating system, thus giving the new
> > owner a clean system to mess up as she/he sees fit.  Or, this
> > is what I've done when I've bought used computers...
> 
> In the end that's what I did.
> 
> Even though I 'deleted' all my personal files, when I went to do a clean 
> install with a reformatted drive I could not "erase" it in Disk Utility 
> while it was in FileVault2 status.
> 
> So I took it out of FV2 status and it promptly decrypted what I assume 
> is the entire drive - it took about 12 hours.  So it seems it decrypted 
> every sector on the disk and therefore private data (though "deleted") 
> is potentially exposed to anyone who wants to really sniff.
> 
> So, I re-installed the OS on the freshly formatted drive and I'm running 
> "Erase Free Space" (simplest/fastest which I assume is probably just 
> 0's) to be sure the disk is clean of all my dirty secrets.
> 
> Or more importantly, the clean ones.

Who can blow that kind of time piddling with an old computer?

The old hard drive can be removed & destroyed in a few minutes[1]... 
affording a quick clean break; complete with absolutely no lingering 
possibility of data theft/mineing once the machine is out of your 
physical control. If someone wants the old machine, let them grab a new 
drive, install and load up as they see fit...

Life is too short...

Erik

And if you play your cards right, you'll end up with some extra cool 
refrigerator magnets!

[toc] | [prev] | [next] | [standalone]

#50139

On 2013.10.17 20:27 , Erik wrote:
> In article <YcydnfJJIYkKwf3PnZ2dnUVZ_rqdnZ2d@giganews.com>,
>   Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>
>> On 2013.10.15 18:49 , billy@MIX.COM wrote:
>>> Alan Browne <alan.browne@freelunchvideotron.ca> writes:
>>>
>>>> So I'm selling my older iMac.
>>>>
>>>> Filevault 2 is on.
>>>>
>>>>       So if I
>>>>           delete all the files
>>>>           Remove the account
>>>>           Turn off filevault2
>>>>
>>>> Then I assume the files are practically unrecoverable (I'll destroy the
>>>> recovery key as well, naturally...).
>>>
>>> If I was selling a computer with is disks, I'd zero them out
>>> and then reinstall the operating system, thus giving the new
>>> owner a clean system to mess up as she/he sees fit.  Or, this
>>> is what I've done when I've bought used computers...
>>
>> In the end that's what I did.
>>
>> Even though I 'deleted' all my personal files, when I went to do a clean
>> install with a reformatted drive I could not "erase" it in Disk Utility
>> while it was in FileVault2 status.
>>
>> So I took it out of FV2 status and it promptly decrypted what I assume
>> is the entire drive - it took about 12 hours.  So it seems it decrypted
>> every sector on the disk and therefore private data (though "deleted")
>> is potentially exposed to anyone who wants to really sniff.
>>
>> So, I re-installed the OS on the freshly formatted drive and I'm running
>> "Erase Free Space" (simplest/fastest which I assume is probably just
>> 0's) to be sure the disk is clean of all my dirty secrets.
>>
>> Or more importantly, the clean ones.
>
> Who can blow that kind of time piddling with an old computer?

What time?  I set it do something and ignore it while it chugs away.

Old?  mid-2007 and lots of life left in it.  It will suit someone.

> The old hard drive can be removed & destroyed in a few minutes[1]...

Getting into the HD and out again (mid 2007 iMac) takes about 45 minutes 
if you're not in a rush - and one should not rush as there are few 
delicate things that could get broken.

> affording a quick clean break; complete with absolutely no lingering
> possibility of data theft/mineing once the machine is out of your
> physical control. If someone wants the old machine, let them grab a new
> drive, install and load up as they see fit...

The disk has now been erased from end to end following the install of 
the new OS.  I have little doubt that anything of use hasn't been wiped.

The HD also represents embodied energy (and pollution) in making it and 
delivering it.  So conservation is a bonus (three-R's).

>
> Life is too short...

It's something I can do while otherwise wasting my time on other things 
(or sleeping or working - since that's when most of the decrypting and 
erasing took place).

-- 
"Quotation, n: The act of repeating erroneously the words of another."
                                                 -Ambrose Bierce

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.sys.mac.system

csiph-web