Hacker News Reader

Comment by nwellinghoff | Hacker News Reader

Wait, so you can't recover data off a drive if you analyze it from another machine? Surely this is only if the drive in encrypted right?

View on HN

> If you have a Mac with Apple silicon or an Apple T2 Security Chip, your data is encrypted automatically.

Even if you don't have FileVault (macOS disk encryption) enabled, data on SSD (or NAND chips with Apple silicon) is encrypted, so it's quite unlikely that you would be able to recover anything.

Not to mention that SSD/chips are soldered on the motherboard.

If the computer still turns on you can at least get to recovery and use USB-C/Thunderbolt disk sharing.

This thread is referencing if the SSD fails. If the SSD fails, the computer won't turn on, and even if it could (which we wish were the case, but the T2 chip prevents), you couldn't use get anything off the disk because it's a dead SSD.

In the event of an OS crash/issue, or just minor corruption, that might be an option. Related to the original article -- I'm not sure what is meant by DFU mode on a MacBook (only have heard of that on iDevices) so it's unclear to me if you can EFI boot into another OS. Given that it also affects Asahi Linux, sounds like you can't EFI boot into anything, even OS Recovery for Mac Sharing mode.

The architecture of Apple Silicon Macs is shared with iPhones and iPads and there isn’t an EFI environment. DFU mode on a Mac works the same as an iPhone and lets you restore from another computer.

https://support.apple.com/guide/apple-configurator-mac/reviv...

There is no EFI on Apple Silicon. It's a more iOS-ish pre-boot environment (based around iBoot and some other Apple-y things).

There's also not exactly a boot picker in firmware-- that lives in the recovery OS. Which will also be unbootable if you're impacted by this issue because it's a minimal macOS environment; if your only OS is 13.6/13.6.1, that recovery partition will also be 13.6/13.6.1, and, if you have upgraded to 14.0/14.1, that installer can fail to update the recovery partition and leave it at 13.x (whatever you were on when you upgraded).

In this case what is the point of FileVault?

The data is encrypted at rest regardless, but if FileVault isn’t enabled it unlocks without a password when you power on.

Makes sense, thanks!

unlocks without a password

That suggests its only goal is to frustrate right-to-repair and data recovery. Also as a way to sell their cloud backup solution.

"Sorry, we can't recover anything, but you should've used iCloud!"

Aren't there laws against these sorts of business practices?

It makes the “factory reset” button work instantaneously instead of taking several hours. Supporting the secondary market with convenient wiping should be encouraged from an environmental point of view.

Does this really "support the secondary market"? Are there people who want to sell their machine but would be discouraged by the "several hours" it takes for it to reset?

This isn't really an Apple exclusive feature or anything, it's basically the same as self encrypting SSDs.

Reply on news.ycombinator.com