Apple's Not So Secure Empty Trash


It's common to read in electronic discovery guides that Macs have an option called 'Secure Empty Trash' which allows users to overwrite deleted files with zeroes. (You'd see the option if you held down the command key when opening Trash). We know deleted files are not really removed from your computer and can be recovered rather easily with programs like Tokiwa, as described in the Tip of the Night for May 30, 2015. Apple's Secure Empty Trash was designed to give Mac users a way to permanently delete files. However the new El Capitan operating system is missing this feature. Apple deliberately chose to remove the feature because someone with very sophisticated forensic skills could still recover files overwritten with zeroes as an electromagnetic ghost. See this posting on macworld.com.

One way of forcing the Apple El Capitan OS to overwrite a file is to use the SRM command. Just follow these steps

1. Press the command key + the space bar and bring up 'Terminal' in Spotlight Search.

2. Move the files you want to securely delete to a folder on your desktop In this example we've named this folder 'delete'.

3. Enter this command in Terminal:

SRM -RVF /Users/[user name]/Desktop/delete

Your file should be securely erased. See this posting.

#SecureEmptyTrash #MACSRMcommand