How To Prepare a Mac For Sale | Hacker News Reader

How To Prepare a Mac For Sale

danbenjamin.com

13 pointsdanbenjamin10 comments

There's still a problem about the "factory fresh" feeling : when you turn a brand new Mac on for the first time, you also have iLife already installed. I always specify to people I sell my Mac to that iLife is ready. Here's how to complete the "factory fresh effect" :

- When you have just shut the computer down after the introduction video, reboot it in Target Mode pressing cmd-T (hey, you're not already selling a unibody MacBook, so there still is a Firewire port!). - Connect another Macintosh with a Firewire cable. The old one is mounted just like an external hard drive. An expensive 2GHz Core 2 Duo external hard drive. - Use that Macintosh to drag'n'drop iLife suite into the old MacBook's Applications folder. - "Et voilà !"

Neat trick.

The install disks that came with my MacBook (bought last August) had the ability to install iLife with the rest of the operating system, so before you get tricky with FireWire, you should check to see if the program is on the install DVDs.

They mention zeroing out the disk to prevent the next owner from recovering your data.. actually using a 7 pass method.

How does this apply to SSDs? While I suppose a global use increment by 7 isn't terrible, it does make me cringe a little.

While SSDs do wear out, it's very rare to actually end up with enough bad blocks to run out of spare space. The write limit comes up whenever you mention SSDs, but on a desktop or laptop computer it seems to be pretty much irrelevant.

I do have to wonder why people still recommend 7-pass zeroing of hard disks when The Great Zero Challenge http://news.ycombinator.com/item?id=117588 still stands, and there is no evidence that it's possible to recover from a simple dd if=/dev/zero.

With SSDs, there is the issue of certain blocks remaining untouched after zeroing due to the wear leveling logic, although I doubt you'd need 7 passes to flush it out - 1 pass with random bits and 1 pass with zeroes ought to suffice. (the assumption being that this will touch even the masked blocks, whereas two passes of zeroes will be detected, and already-zero blocks won't be blanked, whereas a zero pass following a random pass will start by zeroing unmapped blocks; if anyone knows the wear leveling algorithms better than me, feel free to confirm/refute)

Gah. I had initially replied to the parent post with the Great Zero Challenge link, submitted and saw that you beat me. :)

AFAIK, the technique for magnetic disk recovery after one dd pass is to remove the heads and attempt to retrieve the data using laboratory equipment (more sensitive than the original heads and _vastly_ more time consuming than the commercial data recovery procedures).

You can't do that with SSDs, maybe you could attack the flash controller and exploit something like a timing attack, or maybe you could try your luck against the load leveling algorithms and dump the data from the flash chips themselves, although this would involve at least desoldering the flash chips in a big device or doing something nastier in an integrated package like a CF card. If you lose there, the next stop would seem to be something involving an electron microscope and trying to identify cells that used to be a zero and are a one now, and vice-versa -- judging from: http://hackaday.com/2008/01/01/24c3-mifare-crypto1-rfid-comp... it seems like state of the art currently is individual gate analysis, I think this would have to go farther.

From a commercial perspective, it seems like there still is some drive to build better tools: http://www.theinquirer.net/gb/inquirer/news/2008/10/28/flash...

tl;dr: I agree, unless you are doing something criminal, I would use a single dd if=/dev/zero of=/dev/diskdevice and get on with life.

Magnetic discs:

I agree with you that it ought to be possible in principle, although I find it unlikely that data recovery companies would pass up revenue when they're quite able to do it. The only explanation to me would be that they're being paid off by somebody, e.g. governments, but again... WHY? My theory is that it used to be possible, back when the data density was much lower, larger chunks of material were involved.

SSDs:

I would have thought that decoupling the flash chips from the controller logic is the easiest way to get at any hidden data. You'll have to piece the data together unless you can reverse-engineer the load-balancing algorithm, although there won't be much left after one pass of zeroing anyway. I have my doubts that you can get at residual charge from previous bit values in a useful way.

I've heard people with more paranoida than sense claim that recovery labs (like, say, in the NSA) can 'peel' off passes. Effectively they can view he state of a given drive sector after N writes. If you do complete passes of writing zeroes (or even random numbers), the theory is the spooks can still view your stuff.

To counter this people have written disk cleaning utilities that will write random values to a random subset of the disk each pass. After a few passes of writing randoms to a random subset (say 50% of the sectors) it becomes REALLY hard to know what was on the disk because there is no way to 'peel' off a layer.

Practical speaking... if you're defending yourself against someone with the ability and motivation to do more than a simple Norton undelete there are better options. I believe the standard practice for Defense contractors is to pass a magnetizing wand over the drives then throw them into a massive shredder.

All of this is way overkill for a person who wants to erase their online passwords and letters to mistresses.

It would have been helpful if the author had talked about how to find a buyer -- is there a Mac-oriented site with classifieds, or is it best to try one's luck with Craigslist?

reinstall the os?

Reply on news.ycombinator.com