When you delete a file by putting it in the Trash and then emptying the Trash, you might think it’s somehow gone forever. But file deletion ironically doesn’t erase the file from your drive. It simply makes a change to the disk’s catalog indicating that the space occupied by that file is available and can be overwritten with something else if and when necessary.
As a result, even if you’ve deleted a file, someone using file-recovery software could potentially undelete it later, as long as no other file has been stored in exactly the same spot since then. (That someone may be you if you accidentally deleted the file and don’t have a backup.)
Hard drives may eventually overwrite the deleted file’s freed-up storage with new data, but that isn’t a guarantee that the previous file can’t be recovered. With specialized equipment, it’s sometimes possible to retrieve old versions of files that have been overwritten one or more times with new data. It’s painstaking, technically challenging, and expensive work—which means it would happen only when the stakes are quite high—but it can be done.
With an SSD, it’s even harder to ensure data is gone for good: SSDs use wear leveling, which spreads your data out all over an SSD, as opposed to the specific physical locations that are mapped on an HDD. Each memory cell in an SSD has a maximum number of times in its usable life that it can be erased and rewritten before it fails. Wear leveling ensures that the last previously written-to location is the least likely to be overwritten soon relative to any other location that’s available on the drive. SSDs also employ trim, which tells the controller that a given location is no longer able to be erased. With even more expensive gear than required for HDDs, data can be retrieved to an alarming extent from SSDs.
The good news is that with an Apple silicon Mac, all data on the startup volume is also encrypted by default. You only need to consider external SSDs that you use for storage.
If you’re still using external hard drives, you could conceivably securely delete removed file portions, but Apple dropped a feature for that years ago. However, you can encrypt external HDDs and you can securely erase them before getting rid of them using Disk Utility:
- Open Disk Utility, select the drive or volume, and click Erase.
- Click Security Options.
- Move the slider to the desired level of security and click OK, then click Erase. The slider has four notches:
- Fastest: Regular erase, which doesn’t overwrite the data.
- One-pass: Overwrite the data once with zeroes.
- Three-pass: Overwrite the data three times, twice with random data and once with non-random data.
- Most Secure: Overwrite the data seven times, meeting a U.S. Department of Defense standard.
The three-pass and Most Secure options can take a long time, and are necessary only in extreme cases, but if you want to make it all but impossible for someone to recover a file, you can.
Have the drive destroyed instead
Removable and external SSDs and HDDs can be sent out for secure destruction to outfits that receive licenses or certifications from various organizations. This includes some electronics recyclers who will use a drive crusher right in front of you. Some will give you a certificate that confirms the drive was destroyed. This is bad for the environment, but may be a valid choice if you have any concern about non-FileVault-encrypted drives’ data.
Apple Pay on a second volume
Apple allows Macs with a Secure Enclave and Touch ID enabled to store Apple Pay card information, so you can make purchases in apps and via Safari directly with your fingerprint. There’s no need to use a separate device. Setting up Apple Pay is straightforward, and handled via System Settings > Wallet & Apple Pay.
The security situation you may encounter, however, is when you set up Apple Pay either with another account on the same Mac or on an external startup drive! In the former case, Apple warns you in a notification. In the latter case, when you restart from your primary startup volume, your Mac also alerts you.
I saw both the above errors after restarting from an external bootable clone, because macOS interpreted both conditions as true.
Whether you set it up with a separate macOS user or an external volume, you can reset Apple Pay to work with your current main account with your current volume. However, it involves several steps:
- Open System Settings > Wallet & Apple Pay.
- Click the Add Card button.
- The Mac prompts you about changing back. When prompted, enter your password or use Touch ID to proceed.
- Select the cards you want to use and click Next.
- For each card, you will have to confirm details, such as entering your Apple Account password or the security code on the card. You will also have to accept terms and conditions for many cards, and receive two-factor authentication for some.
Even if Apple Pay is disabled, you can still use it in Safari by approving purchases on your iPhone or Apple Watch. Enable this option in Safari > Settings > Advanced, where you can select “Allow websites to check for Apple Pay and Apple Card.”
