Turn Off FileVault Disk Encryption

Before You Sell Used Mac Mini: Turn Off File Vault Disk Encryption

Turn Off FileVault Disk Encryption

Before You Sell a Used Mac Mini

If you activate FileVault in OS X 10.7 or later, turn it off before selling your old Mac Mini. When you turn off FileVault, encryption is turned off and the contents of your disk are decrypted.

The decrypting could take a while, depending on how much information you have stored. However, you can still use your computer to do other tasks while the decryption is occurring.

To turn off FileVault:

Go to Apple Menu > System Preferences.
Click Security & Privacy.
Click FileVault.
Click the lock to unlock the preferences pane, next enter an administrator name and password.
Click Turn Off FileVault.
Click Turn Off Encryption.

Important note: Deleting documents, contacts, reminders, documents, photo streams, or any other iCloud data while signed in to your iCloud account will lead to the removal of all this content from the iCloud servers. These documents also will be deleted from all of your devices that are signed in to iCloud.

Before You Sell Mac Mini: Don’t Forget to Clean It Up

Physically clean your old Mac Mini before you sell it to get rid of all the dirt and crumbs on the keyboard and mouse. Unplug everything, grab a microfiber cloth and wipe the screen, the keyboard, and the case. If you have one of the older keyboards, turn it upside down and give it a good shake to get food crumbs, dust, and cat hair between the keys.

You can use a vacuum with a soft brush attachment to clean the keyboard. Your used Mac Mini might even need a touch up with iKlear or a similar spray.

A FEW MORE WORDS ABOUT FILEVAULT

According to Wikipedia, FileVault was introduced with Mac OS X Panther (10.3). In the beginning it could only be applied to a user’s home directory, not the startup volume. The operating system uses an encrypted sparse disk image to present a volume for the home directory. Mac OS X Leopard and Mac OS X Snow Leopard use more modern sparse bundle disk images, which spread the data over 8 MB files (called bands) within a bundle. Apple refers to this original iteration of FileVault as Legacy FileVault.

Mac OS X Lion and newer offer FileVault 2, which is a significant redesign. This encrypts the entire OS X startup volume and typically includes the home directory, abandoning the disk image approach.

When FileVault is enabled, the system invites the user to create a master password for the computer. If a user password is forgotten, the master password or recovery key may be used to decrypt the files instead.

Note that migration of FileVault home directories is subject to two limitations:

There must be no prior migration to the target computer.
The target must have no existing user accounts.

If Migration Assistant has already been used, or if there are user accounts on the target: before migration, FileVault must be disabled at the source.

If transferring FileVault data from a previous Mac that uses 10.4, using the built-in utility to move data to a new machine, the data continues to be stored in the old sparse image format, and the user must turn FileVault off and then on again to re-encrypt in the new sparse bundle format.

Instead of using FileVault to encrypt a user’s home directory, using Disk Utility, users can create an encrypted disk image themselves and store any subset of their home directory in there. This encrypted image behaves similar to a Filevault encrypted home directory, but is under the user’s maintenance.

Encrypting only a part of a user’s home directory might be problematic when applications need access to the encrypted files, which will not be available until the user mounts the encrypted image. This can be mitigated to a certain extent by making symbolic links for these specific files.

Because FileVault restricts the ways in which other users’ processes can access the user’s content, some third-party backup solutions can back up the contents of a user’s FileVault home directory if other parts of the computer (including other users’ home directories) are excluded.

Several shortcomings were identified in Legacy FileVault. Its security can be broken by cracking either 1024-bit RSA or 3DES-EDE.

Early versions of FileVault automatically stored the user’s passphrase in the system keychain, requiring the user to notice and manually disable this security hole.

In 2006, following a talk at the 23rd Chaos Communication Congress, titled Unlocking FileVault: An Analysis of Apple’s Encrypted Disk Storage System, Jacob Appelbaum and Ralf-Philipp Weinmann released VileFault, which decrypts encrypted Mac OS X disk image files.

A free space wipe using Disk Utility left a large portion of previously deleted file remnants intact. Similarly, FileVault compact operations only wiped small parts of previously deleted data.