There’s extensive experience in recovering deleted files from hard disks, and results can be surprisingly good. Recovery from SSDs is more tricky, and secure ‘wiping’ ensures nothing can ever be recovered, making good backups essential.
encryption
How FileVault and APFS Encrypted are enabled and managed differently, and details of how they work internally. Concentrates on T2 and Apple silicon Macs, but also covers older Intel models.
First securing the Home folder in an encrypted sparse disk image, then to whole-volume encryption using CoreStorage, now using T2 and Apple silicon chips.
Could old images be retained on a device or your Mac after you had securely erased it using Erase Assistant?
How to obtain and read entries in the Unified log made by APFS. Their structure, and a guide to their identification and occurrence.
Keybags, wrapping keys, VEKs and KEKs all explained. Did you realise how Recovery Keys are implemented? Or how the SSV protects against read errors?
Recent oddities with FileVault Recovery Keys, and a new exploit GoFetch, raise concerns over how secure FileVault protection is.
You’ve just updated to 14.4 or 14.4.1 and are prompted to set up a new Recovery Key for FileVault. What do you do next, and how should you check the key?
