Executing "xartutil --erase-all" in Terminal as effective as erasing my SSD in Disk Utility?

[Luba]

Long story, but couldn't use Disk Utility because of a bad display. Executing "xartutil --erase-all" as effective as erasing my SSD? A Google search said to execute "xartutil --erase-all" in Terminal on Recovery HD, but since I couldn't "see" anything in Recovery HD because of my bad display, I executed "xartutil --erase-all" in my Administrator account. I'm pretty sure it worked, so why do the internet articles say to only use xartutil --erase-all in Recovery HD?

 

[Taz Mangus]

I executed "xartutil --erase-all" in my Administrator account. I'm pretty sure it worked, so why do the internet articles say to only use xartutil --erase-all in Recovery HD?

In Recovery mode the internal drive is not mounted. You can‘t erase the drive that you are running from. I suspect the command you tried to use did not complete successfully. Think about it for a minute, if you were able to erase the internal drive in normal running mode, you would erase all the OS files and your user account while you are logged into your user account. The computer would stop functioning because you just wiped out the OS.

If your display is broken how were you able start the Terminal and know it was running?

 

[bogdanw]

xartutil --erase-all

That command is for something else, see https://osxdaily.com/2017/12/21/delete-touch-bar-data-mac/

 

[chrfr]

That command is for something else, see https://osxdaily.com/2017/12/21/delete-touch-bar-data-mac/

On T2-equipped computers, xartutil --erase-all will also get rid of the disk decryption keys stored in the secure enclave, so it'll make the data on the disk unreadable and unrecoverable.
[automerge]1592412303[/automerge]

Long story, but couldn't use Disk Utility because of a bad display. Executing "xartutil --erase-all" as effective as erasing my SSD? A Google search said to execute "xartutil --erase-all" in Terminal on Recovery HD, but since I couldn't "see" anything in Recovery HD because of my bad display, I executed "xartutil --erase-all" in my Administrator account. I'm pretty sure it worked, so why do the internet articles say to only use xartutil --erase-all in Recovery HD?

What computer are you using?

 

[Luba]

On T2-equipped computers, xartutil --erase-all will also get rid of the disk decryption keys stored in the secure enclave, so it'll make the data on the disk unreadable and unrecoverable.
[automerge]1592412303[/automerge]

What computer are you using?

2019 MacBook Pro 16" which has the T2 enclave chip.
[automerge]1592413738[/automerge]

In Recovery mode the internal drive is not mounted. You can‘t erase the drive that you are running from. I suspect the command you tried to use did not complete successfully. Think about it for a minute, if you were able to erase the internal drive in normal running mode, you would erase all the OS files and your user account while you are logged into your user account. The computer would stop functioning because you just wiped out the OS.

If your display is broken how were you able start the Terminal and know it was running?

In Recovery the display was blank, couldn't see a thing, but the login screen was only garbled so I could login and depending on what app I was using could see some of the display. Also the display was "dying" on me as I was using it, so I think I just put in that Terminal command just in time.
[automerge]1592413907[/automerge]

On T2-equipped computers, xartutil --erase-all will also get rid of the disk decryption keys stored in the secure enclave, so it'll make the data on the disk unreadable and unrecoverable.
[automerge]1592412303[/automerge]

What computer are you using?

So getting rid of the disk decryption keys using xartutil --erase-all is as effective or maybe more effective than erasing the SSD using Disk Utility since xartutil --erase-all makes data unreadable and unrecoverable?

 

[Luba]

In Recovery mode the internal drive is not mounted. You can‘t erase the drive that you are running from. I suspect the command you tried to use did not complete successfully. Think about it for a minute, if you were able to erase the internal drive in normal running mode, you would erase all the OS files and your user account while you are logged into your user account. The computer would stop functioning because you just wiped out the OS.

If your display is broken how were you able start the Terminal and know it was running?

Didn't erase the internal drive (SSD) erased T2 security enclave chip that internet articles said had to be done using Recovery: "And yes you must boot the Mac from Recovery Mode (or Internet Recovery) to accomplish this task" (https://osxdaily.com/2017/12/21/delete-touch-bar-data-mac/), but I executed using Terminal in my regular Administrator account. I tried to login back in (I'm quite sure I used the correct login password), but couldn't so it seems I don't have to execute "xartutil --erase-all" in Terminal on Recovery!?!

 

[bogdanw]

On T2-equipped computers, xartutil --erase-all will also get rid of the disk decryption keys stored in the secure enclave, so it'll make the data on the disk unreadable and unrecoverable.

Good to know, an undocumented command that can brick T2 Macs.

 

[chrfr]

Good to know, an undocumented command that can brick T2 Macs.

Yeah, I guess this is a good argument in favor of firmware passwords.
[automerge]1592417663[/automerge]

So getting rid of the disk decryption keys using xartutil --erase-all is as effective or maybe more effective than erasing the SSD using Disk Utility since xartutil --erase-all makes data unreadable and unrecoverable?

It can't hurt, I suppose. It also isn't necessary if you've enabled FileVault and then erase the disk.
Without seeing what your computer is actually showing on screen I'd have fairly low confidence that the command worked and that your data is erased. Can you connect an external display?

 

[Luba]

Yeah, I guess this is a good argument in favor of firmware passwords.
[automerge]1592417663[/automerge]

It can't hurt, I suppose. It also isn't necessary if you've enabled FileVault and then erase the disk.
Without seeing what your computer is actually showing on screen I'd have fairly low confidence that the command worked and that your data is erased. Can you connect an external display?

Display has now been replaced by Apple, and I've already formatted and restored my backup from Time Machine.

I did have FileVault enabled. Before sending MacBook to Apple for repair I used "xartutil --erase-all" since I couldn't use Disk Utility. I hoped "xartutil --erase-all" is the equivalent of erasing my SSD. When Disk Utility erases my FileVault SSD does it simply just delete my decryption keys? If yes, then I guess it's the equivalent of "xartutil --erase-all"??

How does Disk Utility erase a FileVault SSD? Would the additional step of getting rid of the decryption keys make the data on my SSD more unrecoverable? I'm not knowledgeable on how SSD works. I know on a HDD you need to overwrite it to make the data unrecoverable. Or maybe with an encrypted HDD there's no need to overwrite it, just delete the decryption keys??

 

[NoBoMac]

I hoped "xartutil --erase-all" is the equivalent of erasing my SSD. When Disk Utility erases my FileVault SSD does it simply just delete my decryption keys? If yes, then I guess it's the equivalent of "xartutil --erase-all"??

How does Disk Utility erase a FileVault SSD? Would the additional step of getting rid of the decryption keys make the data on my SSD more unrecoverable?

Take with a huge grain of salt...

From my understanding of Macs with T chips and SSDs, APFS file system is very iOS-ish in that all files are encrypted with a unique key (which is encrypted with a system key, and that encryption is encrypted with yet a different system key) when written via the T chip (all I/O goes through the T), decrypted on read. When the xartutil command is run, as mentioned by others, the system keys, finger prints, etc. get wiped out, making the disk unreadable. Basically, you erased the drive.

Enabling FileVault merely adds an extra layer of security. Doesn't really encrypt anything. Just adds the layer of who can unlock the drive.

From what I've seen, FileVault on APFS systems works somewhat like it does on HDDs systems at boot time. There still is an encrypted file named "EncryptedRoot.plist.wipekey" buried in the Preboot "hidden" volume. That file contains the user ids of unlockers, their hashed passwords, and the encrypted recovery key. Speculation, disabling FileVault merely removes the wipekey when using APFS. When you enable FileVault on APFS, it's instant as no file encryption is happening, only add the extra layer of security.

Imo, running an erase in Disk Utility is not needed if on a Mac with T chip.

Aside: never seen any real authoritative documentation on APFS and how this all really works. In the case of Macs without a T chip, guessing turning on FileVault uses APFS single-key encryption mode (FileVault "classic") vs. multi-key on T-chip Macs.

 

[KALLT]

@NoBoMac there is this overview by Apple that corroborates what you wrote.

In a nutshell: Macs with T2 chip always use volume encryption where the chip itself holds the decryption key. Enabling FileVault adds another key to the decryption mechanism, requiring both keys to decrypt the volume. If the T2 chip’s decryption key is destroyed (e.g. by xartutil), the data becomes inaccessible, regardless whether FileVault was enabled. The paper I linked to implies that a reformat (“erase”) in Disk Utility instructs the T2 chip to destroy the volume key also (like xartutil would do).

On Macs without a T2 chip, Disk Utility would reformat the disk (i.e. create a new partitioning scheme on top of the existing one), mark the previous storage bits (i.e. the encrypted data) as dirty and send a Trim command to the SSD controller to actually erase the data from the storage cells (it is not clear though whether this happens instantly or at a later time). My guess is that this happens on Macs with a T2 chip also, with the additional step of instructing the T2 chip to discard the volume decryption key.

 

[Taz Mangus]

The question I have is if you issue the xartutil --erase-all command and you remove the drive from the computer and placed it in a external enclosure, could you access the data on that drive from another Mac that has Catalina installed on it?

 

[KALLT]

The question I have is if you issue the xartutil --erase-all command and you remove the drive from the computer and placed it in a external enclosure, could you access the data on that drive from another Mac that has Catalina installed on it?

To my knowledge, the storage chips of T2 Macs are soldered onto the mainboard. Data encrypted by the T2 cannot be accessed without it. If you did use xartutil, then nothing can decrypt that data anymore.

 

[chrfr]

The question I have is if you issue the xartutil --erase-all command and you remove the drive from the computer and placed it in a external enclosure, could you access the data on that drive from another Mac that has Catalina installed on it?

Even if you don't use that command, and you take the disk out of an iMac Pro or Mac Pro (they're soldered on chips in the portables) the disk would be unreadable because the encryption codes are held in the secure enclave in that specific Mac.

 

[Taz Mangus]

To my knowledge, the storage chips of T2 Macs are soldered onto the mainboard. Data encrypted by the T2 cannot be accessed without it. If you did use xartutil, then nothing can decrypt that data anymore.

Even if you don't use that command, and you take the disk out of an iMac Pro or Mac Pro (they're soldered on chips in the portables) the disk would be unreadable because the encryption codes are held in the secure enclave in that specific Mac.

Thank you the information.

 

[NoBoMac]

Data encrypted by the T2 cannot be accessed without it. If you did use xartutil, then nothing can decrypt that data anymore.

Even if you don't use that command, and you take the disk out of an iMac Pro or Mac Pro (they're soldered on chips in the portables) the disk would be unreadable because the encryption codes are held in the secure enclave in that specific Mac.

These.

And ignore some of what I wrote in the earlier post.

Found the latest Apple Security Whitepaper (covers all platforms vs old one was just iOS).

https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf

Regarding FileVault (page 47):

• FileVault off and a T2 chip, the unique ID in the Secure Enclave is used to encrypt files
• Turn on FileVault with a T2 chip, you get the multi-key encryption (though it's less iOS-y than I thought) plus the unlockers screen.
• Machines without T2, "classic" FileVault

So, yeah, can't move an APFS drive from a T2 machine to a different one and hope to read it.

 

[Luba]

Yes, great info. Why are articles saying I need to use xartutil command in Recovery? I executed xartutil on my regular Admin account. Would that work? It seemed to work because afterwards when I tried to login it said my password was bad, but I know I typed it correctly. The T2 is considered a completely separate drive from my internal SSD, correct?

 

[chrfr]

Yes, great info. Why are articles saying I need to use xartutil command in Recovery? I executed xartutil on my regular Admin account. Would that work? It seemed to work because afterwards when I tried to login it said my password was bad, but I know I typed it correctly. The T2 is considered a completely separate drive from my internal SSD, correct?

The T2 does a lot of things in the computer, including acting as the disk controller. The T2 doesn't have its own disk if that's what you mean, but the Secure Enclave stores things like your Touch ID credentials and your Apple Pay info, so while it's very unlikely the next owner of your computer would be able to gain access to that, clearing the data from the enclave can't hurt.

 

[bogdanw]

The recovery key can be used to read FileVault 2 APFS drives
From Apple's Whitepaper: "FileVault recovery mechanism (iCloud recovery, FileVault recovery key, and institutional key)"
Elcomsoft Forensic Disk Decryptor:
"FileVault 2 volumes can be decrypted or mounted by using the escrow key (Recovery Key).
FileVault 2 recovery keys can be extracted from iCloud"
https://www.elcomsoft.com/efdd.html