everyday mac tools

Delete a file for good on a Mac: what replaced Secure Empty Trash

· 6 min read

To permanently delete files on a Mac, select them in Finder and press Option-Command-Delete (Delete Immediately), or move them to the Trash and empty it. Secure Empty Trash is gone because overwriting a file cannot be relied on with the flash storage in modern Macs; what replaced it is encryption. With FileVault on, whatever is left behind on the drive is unreadable without your password, which leaves one real job for you: finding the other copies that deleting does not touch.

Why Secure Empty Trash disappeared

Secure Empty Trash was removed in OS X El Capitan (10.11). It worked by overwriting a file’s data before deleting it, which made sense on a spinning hard disk, where data stays physically in the place it was written until something writes over it.

Flash storage does not behave that way. An SSD’s controller spreads writes across its cells to even out wear, keeps spare blocks in reserve, and sends a so-called overwrite to fresh cells. The original data can stay put until the controller erases that block on its own schedule. APFS also writes changes to new blocks rather than modifying old ones in place. An app that claims to have overwritten a file on a modern Mac cannot actually confirm it.

Apple removed the option rather than keep a button that promised more than it could deliver. The srm command went too and is not on current macOS. The -P flag of rm, which once meant “overwrite first”, is still accepted, and its manual page says it has no effect.

Apple’s own manual page for diskutil puts it plainly: under its secure erase command, it says that kind of secure erase is “no longer considered safe” on modern devices, and that the modern solution is encryption, suggesting FileVault. You can read it yourself with man diskutil.

How to permanently delete files on a Mac today

Any of these removes a file from the Mac’s file system. None is more thorough than the others; they differ only in how many steps they take.

  1. Delete Immediately. Select the file in Finder and press Option-Command-Delete, or open the File menu and hold Option: Move to Trash changes to Delete Immediately. Finder asks you to confirm and warns that you cannot undo it.
  2. Empty the Trash. Choose Finder, Empty Trash, or press Shift-Command-Delete. Add Option to skip the confirmation. To remove a single item while leaving the rest, open the Trash, right-click the item and choose Delete Immediately.
  3. Let the Trash empty itself. In Finder, choose Settings (Preferences on older versions), click Advanced and tick “Remove items from the Trash after 30 days”.
  4. In Terminal, rm deletes without the Trash. It is the same as Delete Immediately, with no confirmation, so type the path carefully.

What happens underneath is the same in each case. The file system forgets the file and marks its blocks as free, and macOS tells the SSD those blocks are no longer in use (a mechanism called TRIM), so the drive can erase them. On Apple’s internal SSDs this happens automatically. Recovery tools have far less to work with on an SSD than they did on old hard disks, though nobody can promise exactly when a particular block is cleared.

Why encryption is the real answer

“Could someone get this file back?” usually means “could someone who gets hold of my Mac read what I deleted?”. Encryption answers that completely. With FileVault on, everything written to the internal drive is encrypted with a key tied to your login password, so any fragment of a deleted file left on the flash chips is ciphertext and useless without it. Apple silicon Macs and Intel Macs with a T2 chip encrypt storage in hardware regardless; FileVault is what ties that encryption to your password. To check it, open System Settings, Privacy & Security, and scroll to FileVault.

The same principle handles bigger jobs:

  • Getting rid of a whole Mac. Erase All Content and Settings destroys the encryption keys, which makes everything on the drive unrecoverable in minutes. Erasing a Mac properly before you sell or hand it on has the order to do it in.
  • External drives. Encrypt a drive before sensitive files go on it; erasing it later discards the key with the data. In Finder, right-click the drive and choose Encrypt. For an old spinning hard disk, Disk Utility’s Erase dialog can offer Security Options with overwrite passes; SSDs do not get that choice, for the reasons above.

The copies deleting does not touch

This is where deleted files actually survive. Deleting removes one copy from one place.

Time Machine local snapshots. If Time Machine is on, macOS keeps hourly snapshots on the internal drive, usually for about a day. A file you deleted this afternoon is still inside this morning’s snapshot until that snapshot is thinned. tmutil listlocalsnapshots / in Terminal shows what you have; Time Machine local snapshots are taking space explains how they age out and how to remove them.

The Time Machine backup disk. A file is in every backup made while it existed. Backups on an APFS-formatted disk, the default since macOS 11 Big Sur, are read-only, and you cannot remove a single file from them; you can only delete whole backups (tmutil delete with a backup’s timestamp) or let Time Machine thin old ones as the disk fills. Older HFS+ backup disks allowed removing one item from every backup. Private files and Time Machine goes through the options, including encrypting the backup disk so this matters less.

iCloud. A file deleted from iCloud Drive lands in Recently Deleted for about 30 days, where it can be restored from iCloud.com or the Files app on an iPhone or iPad. Remove it from there if you need it gone sooner. Photos has its own Recently Deleted album with the same idea.

Everywhere else it went. The attachment still in Mail, the image in a Messages thread, the copy in Downloads, the version on a USB stick, and anything you emailed or uploaded. Deleting your copy does nothing to those.

Encrypt early, delete less

The files people most want to destroy were usually sensitive from the start: a passport scan, a tax return, a signed contract. The cleaner approach is to keep them encrypted from day one, so every backup and snapshot of them is already ciphertext. An encrypted disk image made in Disk Utility does that for a folder of such files. Hushbox does it in place from the Finder right-click menu: the file becomes a locked, AES-256 encrypted item in the same folder, so later backups copy the encrypted item. It is honest about what it cannot reach: backups, snapshots and iCloud copies made before you locked the file are unchanged, and removing the plain original, which it does only after checking the locked copy byte for byte, is subject to the same SSD rules as any other deletion. It is not a FileVault replacement; the two work together.

Questions

Is there still a Secure Empty Trash on a Mac? No. It was removed in OS X El Capitan because overwriting cannot be guaranteed on flash storage. Turn on FileVault instead, so that anything left on the drive is encrypted.

Does Option-Command-Delete delete a file permanently? It skips the Trash, so the file is gone at once and cannot be undone from Finder. It is not more secure than emptying the Trash, just one step shorter. Backups and snapshots still hold their copies.

Can deleted files be recovered from a Mac SSD? Much less often than from old hard disks, because the drive clears freed blocks in the background. The realistic ways a deleted file comes back are Time Machine, local snapshots, iCloud’s Recently Deleted and copies elsewhere. With FileVault on, leftovers on the drive are unreadable without your password.

How do I permanently delete a file from Time Machine? On an APFS backup disk, you cannot remove one file; you delete whole backups that contain it, or erase the disk and start a new backup. On an older HFS+ backup disk, individual items can be removed from all backups.