4 ms·

Data recovery is impossible [IN THIS SITUATION for those who want to tell a tale about Linux] given full disk encryption. Even if the SSD were removable, and pr

Data recovery is impossible [IN THIS SITUATION for those who want to tell a tale about Linux] given full disk encryption. Even if the SSD were removable, and presuming there is no issue with the SSD -- they fail too -- there is nothing he could have gotten from it. This is true on modern Windows devices as well. There are devices that use passphrase encryption, or similes, but they're a usability problem so it isn't what Apple does. Devices are lost (failed, stolen, burned, destroyed) as a simple fact of life. Anyone who doesn't have an immediate recovery process with negligible loss simply isn't being a professional. His laptop could have easily been nicked from a coffee shop. It's why most of us simply don't sweat this at all. I will never be in a situation where I'm desperate to recover what's on a device. Remarkable that the comments are full of people speculating about failures and then, remarkably, getting angry and on a soap box about their speculation. Computing device failed. Amazing story at 11!

Aeolun 5y ago
> I will never be in a situation where I'm desperate to recover what's on a device. I will never be in a situation where I’m desperate to recover two months worth of data, but even losing a day is pretty inconvenient.
ajross 5y ago
> Data recovery is impossible in most situations given full disk encryption. Key escrow has been a solved problem for decades, Apple just doesn't implement it (AFAIK, anyway). And it's not like user-managed keys are that hard anyway. I mean, just install any modern Linux distro with a decent pass phrase and you can securely and safely move that SSD between almost any two laptops on the planet. OS X does board-locked enclave-managed storage because iOS does board-locked enclave-managed storage, not because it's the right choice for the problem area. It's not a phone; the guy in the linked article lost 800G of video editting work!
- defaultname 5y ago
  Everyone understands the deal with Apple hardware. No one ever thought you could pull out the SSD and stick it in another device. No one is surprised by this reality. No one planned around doing that unless they were profoundly ignorant. If the T2 failed (it is now integrated right into the M1, so any failure of the mainboard), the data is gone. Everyone should know that by now. So he went in with his scheme regardless of that. And his work had so little value that if his laptop were stolen, if a single rank of the storage failed, etc, he'd be in the same situation. He lost data because he was careless in the same foolish way that we read about so often. But people get to beat their ridiculous anti-Apple drums, so here we are. "OS X does board-locked enclave-managed storage because iOS does board-locked enclave-managed storage" This is boorish noise. Apple does it because it provides strong storage encryption while imposing no performance or usability problems. You like something better - good for you. I don't. I have zero issues with this reality. "I lost all my data!" stories are ridiculous nonsense 99% of the time, and this isn't in the 1%.
  - ajross 5y ago
    > Everyone understands the deal with Apple hardware. The linked article and this thread argues otherwise. But regardless, even if everyone understands "the deal" that doesn't constitute a reply to an argument that this is a bad deal.
- brokenmachine 5y ago
  >the guy in the linked article lost 800G of video editting work! In my experience, video editors are the least backed-up PC users. Large videos are too much data to back up quickly and easily, the deadlines are always yesterday, they're always pushing the hardware's limits, the data is ephemeral so just not quite important enough to pay extra for redundancy, and they know just enough about computers to get themselves in trouble.
- fomine3 5y ago
  See how BitLocker solved https://support.microsoft.com/en-us/windows/finding-your-bitlocker-recovery-key-in-windows-10-6b71ad27-0b89-ea08-f143-056f5ab347d6 https://support.microsoft.com/en-us/windows/finding-your-bit...
pengaru 5y ago
err, linux+dmcrypt puts the key on the encrypted disk which you decrypt with a passphrase to open it. That disk can be moved around, you just need the passphrase to open it. We've been doing this for decades now in linux land...
- deleted 5y ago
  [deleted]
- rpdillon 5y ago
  Yep, works great, and saved me from an costly backup restore a couple of times.
bigiain 5y ago
> I will never be in a situation where I'm desperate to recover what's on a device. ... again. I suspect by far the majority of people who know this, learned this the hard way. I know I did. (And even _after_ learning that, I once left a backpack with my laptop at an outdoor table at a cafe. It also have both the USB drive with my primary backup and the iPod with my secondary backup. I was extremely fortunate that a friendly waitress grabbed it and told management it was mine, and I only spent one sleepless night before collecting it after calling up the next morning... In my defence, this was back before "cloud backup" and high bandwidth internet to make that practical was a thing here. )
perryizgr8 5y ago
Full disk encryption is still done using a key. The owner of the machine will have that key. So he can decrypt the data with the key. Full disk encryption does not mean data recovery is impossible. Your laptop bring owned by Apple, not you is what makes recovery impossible.

Aeolun 5y ago

> I will never be in a situation where I'm desperate to recover what's on a device. I will never be in a situation where I’m desperate to recover two months worth of data, but even losing a day is pretty inconvenient.

ajross 5y ago

> Data recovery is impossible in most situations given full disk encryption. Key escrow has been a solved problem for decades, Apple just doesn't implement it (AFAIK, anyway). And it's not like user-managed keys are that hard anyway. I mean, just install any modern Linux distro with a decent pass phrase and you can securely and safely move that SSD between almost any two laptops on the planet. OS X does board-locked enclave-managed storage because iOS does board-locked enclave-managed storage, not because it's the right choice for the problem area. It's not a phone; the guy in the linked article lost 800G of video editting work!

defaultname 5y ago
Everyone understands the deal with Apple hardware. No one ever thought you could pull out the SSD and stick it in another device. No one is surprised by this reality. No one planned around doing that unless they were profoundly ignorant. If the T2 failed (it is now integrated right into the M1, so any failure of the mainboard), the data is gone. Everyone should know that by now. So he went in with his scheme regardless of that. And his work had so little value that if his laptop were stolen, if a single rank of the storage failed, etc, he'd be in the same situation. He lost data because he was careless in the same foolish way that we read about so often. But people get to beat their ridiculous anti-Apple drums, so here we are. "OS X does board-locked enclave-managed storage because iOS does board-locked enclave-managed storage" This is boorish noise. Apple does it because it provides strong storage encryption while imposing no performance or usability problems. You like something better - good for you. I don't. I have zero issues with this reality. "I lost all my data!" stories are ridiculous nonsense 99% of the time, and this isn't in the 1%.
- ajross 5y ago
  > Everyone understands the deal with Apple hardware. The linked article and this thread argues otherwise. But regardless, even if everyone understands "the deal" that doesn't constitute a reply to an argument that this is a bad deal.
brokenmachine 5y ago
>the guy in the linked article lost 800G of video editting work! In my experience, video editors are the least backed-up PC users. Large videos are too much data to back up quickly and easily, the deadlines are always yesterday, they're always pushing the hardware's limits, the data is ephemeral so just not quite important enough to pay extra for redundancy, and they know just enough about computers to get themselves in trouble.
fomine3 5y ago
See how BitLocker solved https://support.microsoft.com/en-us/windows/finding-your-bitlocker-recovery-key-in-windows-10-6b71ad27-0b89-ea08-f143-056f5ab347d6 https://support.microsoft.com/en-us/windows/finding-your-bit...

pengaru 5y ago

err, linux+dmcrypt puts the key on the encrypted disk which you decrypt with a passphrase to open it. That disk can be moved around, you just need the passphrase to open it. We've been doing this for decades now in linux land...

deleted 5y ago
[deleted]
rpdillon 5y ago
Yep, works great, and saved me from an costly backup restore a couple of times.

bigiain 5y ago

> I will never be in a situation where I'm desperate to recover what's on a device. ... again. I suspect by far the majority of people who know this, learned this the hard way. I know I did. (And even _after_ learning that, I once left a backpack with my laptop at an outdoor table at a cafe. It also have both the USB drive with my primary backup and the iPod with my secondary backup. I was extremely fortunate that a friendly waitress grabbed it and told management it was mine, and I only spent one sleepless night before collecting it after calling up the next morning... In my defence, this was back before "cloud backup" and high bandwidth internet to make that practical was a thing here. )

perryizgr8 5y ago

Full disk encryption is still done using a key. The owner of the machine will have that key. So he can decrypt the data with the key. Full disk encryption does not mean data recovery is impossible. Your laptop bring owned by Apple, not you is what makes recovery impossible.