A company Mac is more than hardware: it holds emails, documents, passwords and customer data. Before a MacBook goes to a buyer, is returned at the end of a contract or is disposed of, its data must be erased permanently, so that it can’t be recovered. With SSDs, which all modern Macs have, ordinary methods are not enough. Here is how to do it properly.
Why deleting files is not enough
Moving files to the Trash and emptying it, or quickly formatting the drive, gives no certainty that the data can’t be recovered. On older hard drives, data could be overwritten several times. Apple offers no such option for SSDs: according to the Disk Utility User Guide, secure erase options are not available for SSDs. Instead, Apple recommends turning on FileVault encryption when you start using the drive.
That is why, on an SSD, what matters most is an erase method that doesn’t rely on overwriting data.
How Apple permanently erases data: removing the encryption keys
Newer Macs encrypt the data on the drive. Erase All Content and Settings doesn’t overwrite the whole drive; it removes the encryption keys. According to Apple, erasing “removes all keys from the device’s effaceable storage, making all user data cryptographically inaccessible”. Without the keys, the data can’t be read.
When you can use it: on a Mac with Apple silicon (M1 or later) or the Apple T2 Security Chip, running macOS 12.0.1 or later. The feature erases all user data and any additional volumes, and on Macs with Apple silicon it also restores the default security policy (Full Security).
Where to find it (macOS 13 or later): Apple menu → System Settings → General → Transfer or Reset → Erase All Content and Settings.
According to Apple, if you can use this feature, you don’t need to take any other steps to prepare the Mac for sale.
Step by step: a company Mac before resale or return
- Back up the data your company needs, or move it to the new computer.
- Release the Mac from company management. If the device is in Apple Business or your MDM system, unenroll it. Otherwise, after a reset it may enrol in your organisation again.
- Use Erase All Content and Settings (newer Macs, see above).
- Older Mac (Intel processor without the T2 chip): sign out of iCloud and iMessage, start up in recovery mode, erase the disk in Disk Utility and reinstall macOS, following Apple’s instructions. Remember that Disk Utility can’t securely erase an SSD. If FileVault was not turned on, consider certified data erasure.
- Check that the Mac starts up to the setup screen (Setup Assistant) without your account.
iPhones and iPads
The principle is the same on iPhone and iPad: Erase All Content and Settings (in the Settings app) removes the keys and makes the data cryptographically inaccessible. Release company iPhones from Apple Business or MDM before erasing them too. We describe the order of the steps in our guide on how to prepare a company iPhone for sale.
When there are many devices or they are damaged
Erasing devices yourself works well for a few working Macs. It gets harder when there are many devices, some are damaged or won’t start. Even damaged or reset devices can hold recoverable data, and a Mac that doesn’t work can’t be reset with the system feature.
In these situations we help:
- we erase all data using certified methods, making sure it is completely destroyed before reuse, resale or disposal,
- in Warsaw, Poznań and Gdańsk we work on site: inventory, data destruction, packing and decommissioning,
- after erasure, we can buy back working devices, and their value can lower the price of new ones.
Personal data and decommissioning devices
If your Macs hold customer or employee data, your company is responsible for protecting it even when the devices leave the organisation. Permanently erasing data before resale, return or disposal is part of that protection. It is worth describing the details in a company device decommissioning procedure.
Preparing MacBooks for sale or return? See how to prepare a company MacBook for sale.