Mac OS X: securely erase free space on a disk volume








  • Use Disk Utility in /Applications/Utilities
    • Select the volume you want to wipe free space, activate Erase tab, then click "Erase Free Space..." button:
    • Select the secure level then click Erase Free Space button:
  • Run diskutil in Terminal:
    diskutil secureErase freespace 1 "/Volumes/Macintosh HD"
    
    where 1 is the secure level. Below are the available levels:
    • 0 - Single-pass zeros.
    • 1 - Single-pass random numbers.
    • 2 - US DoD 7-pass secure erase.
    • 3 - Gutmann algorithm 35-pass secure erase.
    • 4 - US DoE 3-pass secure erase.

Note

The Mac OS Disk Utility (diskutil) does not wipe the file slacks. File slacks is the space after a file's data ends and until the file system block ends, and on a modern harddrive it can constitute gigabytes of data. Forensic investigators frequently find interesting information in file slack.

To wipe the free space as well as the file slacks, use BCWipe from Jetico.


No comments:

Post a Comment