4 ms·

Wait, so you can't recover data off a drive if you analyze it from another machine? Surely this is only if the drive in encrypted right?

watermelon0 3y ago
> If you have a Mac with Apple silicon or an Apple T2 Security Chip, your data is encrypted automatically. Even if you don't have FileVault (macOS disk encryption) enabled, data on SSD (or NAND chips with Apple silicon) is encrypted, so it's quite unlikely that you would be able to recover anything. Not to mention that SSD/chips are soldered on the motherboard.
- vanchor3 3y ago
  If the computer still turns on you can at least get to recovery and use USB-C/Thunderbolt disk sharing.
  - samtheprogram 3y ago
    This thread is referencing if the SSD fails. If the SSD fails, the computer won't turn on, and even if it could (which we wish were the case, but the T2 chip prevents), you couldn't use get anything off the disk because it's a dead SSD. In the event of an OS crash/issue, or just minor corruption, that might be an option. Related to the original article -- I'm not sure what is meant by DFU mode on a MacBook (only have heard of that on iDevices) so it's unclear to me if you can EFI boot into another OS. Given that it also affects Asahi Linux, sounds like you can't EFI boot into anything, even OS Recovery for Mac Sharing mode.
    - Moto7451 3y ago
      The architecture of Apple Silicon Macs is shared with iPhones and iPads and there isn’t an EFI environment. DFU mode on a Mac works the same as an iPhone and lets you restore from another computer. https://support.apple.com/guide/apple-configurator-mac/revive-or-restore-a-mac-with-apple-silicon-apdd5f3c75ad/mac https://support.apple.com/guide/apple-configurator-mac/reviv...
    - JonathonW 3y ago
      There is no EFI on Apple Silicon. It's a more iOS-ish pre-boot environment (based around iBoot and some other Apple-y things). There's also not exactly a boot picker in firmware-- that lives in the recovery OS. Which will also be unbootable if you're impacted by this issue because it's a minimal macOS environment; if your only OS is 13.6/13.6.1, that recovery partition will also be 13.6/13.6.1, and, if you have upgraded to 14.0/14.1, that installer can fail to update the recovery partition and leave it at 13.x (whatever you were on when you upgraded).
- School-Cotton 3y ago
  In this case what is the point of FileVault?
  - MagerValp 3y ago
    The data is encrypted at rest regardless, but if FileVault isn’t enabled it unlocks without a password when you power on.
    - School-Cotton 3y ago
      Makes sense, thanks!
    - userbinator 3y ago
      unlocks without a password That suggests its only goal is to frustrate right-to-repair and data recovery. Also as a way to sell their cloud backup solution. "Sorry, we can't recover anything, but you should've used iCloud!" Aren't there laws against these sorts of business practices?
      - callalex 3y ago
        It makes the “factory reset” button work instantaneously instead of taking several hours. Supporting the secondary market with convenient wiping should be encouraged from an environmental point of view.
        remram 3y ago
        Does this really "support the secondary market"? Are there people who want to sell their machine but would be discouraged by the "several hours" it takes for it to reset?
      - vanchor3 3y ago
        This isn't really an Apple exclusive feature or anything, it's basically the same as self encrypting SSDs.

watermelon0 3y ago

> If you have a Mac with Apple silicon or an Apple T2 Security Chip, your data is encrypted automatically. Even if you don't have FileVault (macOS disk encryption) enabled, data on SSD (or NAND chips with Apple silicon) is encrypted, so it's quite unlikely that you would be able to recover anything. Not to mention that SSD/chips are soldered on the motherboard.

vanchor3 3y ago
If the computer still turns on you can at least get to recovery and use USB-C/Thunderbolt disk sharing.
- samtheprogram 3y ago
  This thread is referencing if the SSD fails. If the SSD fails, the computer won't turn on, and even if it could (which we wish were the case, but the T2 chip prevents), you couldn't use get anything off the disk because it's a dead SSD. In the event of an OS crash/issue, or just minor corruption, that might be an option. Related to the original article -- I'm not sure what is meant by DFU mode on a MacBook (only have heard of that on iDevices) so it's unclear to me if you can EFI boot into another OS. Given that it also affects Asahi Linux, sounds like you can't EFI boot into anything, even OS Recovery for Mac Sharing mode.
  - Moto7451 3y ago
    The architecture of Apple Silicon Macs is shared with iPhones and iPads and there isn’t an EFI environment. DFU mode on a Mac works the same as an iPhone and lets you restore from another computer. https://support.apple.com/guide/apple-configurator-mac/revive-or-restore-a-mac-with-apple-silicon-apdd5f3c75ad/mac https://support.apple.com/guide/apple-configurator-mac/reviv...
  - JonathonW 3y ago
    There is no EFI on Apple Silicon. It's a more iOS-ish pre-boot environment (based around iBoot and some other Apple-y things). There's also not exactly a boot picker in firmware-- that lives in the recovery OS. Which will also be unbootable if you're impacted by this issue because it's a minimal macOS environment; if your only OS is 13.6/13.6.1, that recovery partition will also be 13.6/13.6.1, and, if you have upgraded to 14.0/14.1, that installer can fail to update the recovery partition and leave it at 13.x (whatever you were on when you upgraded).
School-Cotton 3y ago
In this case what is the point of FileVault?
- MagerValp 3y ago
  The data is encrypted at rest regardless, but if FileVault isn’t enabled it unlocks without a password when you power on.
  - School-Cotton 3y ago
    Makes sense, thanks!
  - userbinator 3y ago
    unlocks without a password That suggests its only goal is to frustrate right-to-repair and data recovery. Also as a way to sell their cloud backup solution. "Sorry, we can't recover anything, but you should've used iCloud!" Aren't there laws against these sorts of business practices?
    - callalex 3y ago
      It makes the “factory reset” button work instantaneously instead of taking several hours. Supporting the secondary market with convenient wiping should be encouraged from an environmental point of view.
      - remram 3y ago
        Does this really "support the secondary market"? Are there people who want to sell their machine but would be discouraged by the "several hours" it takes for it to reset?
    - vanchor3 3y ago
      This isn't really an Apple exclusive feature or anything, it's basically the same as self encrypting SSDs.