Handing in macbook with root access - protecting data

Question

There is a macbook with a badly swollen battery that will have to be replaced. The macbook itself is out of warranty, and even though the public Apple site lists an option to get it serviced out of warranty anyway, that option disappears when logging in with the associated Apple ID.

There is a Premium Reseller nearby that can replace the battery, but they require, aside from the laptop itself (obviously) full root access in the form of the password of an active administrator account.

Are there any tips for protecting the data on the laptop? Just erasing all data isn't quite enough on an SSD as all data can easily be retrieved if I'm not mistaken. The laptop doesn't have a T2 chip, if that makes any difference (2014 model). Are there any tips on this matter?

Answer 1

To my knowledge, it is not easy to retrieve data deleted from an SSD. If TRIM is turned on (and it will be on a MacBook in most situations), there is no way for the operating system to retrieve the contents of a block that has been erased. Specialized forensic analysis software can read deleted blocks that have not yet been overwritten, but this is only possible with certain SSDs.

If you wanted to be very careful, I would suggest the following:

1. Turn on FileVault and wait for the volume to be fully encrypted.
2. Boot into recovery mode and erase the disk.

An article about recovering data from SSDs: Afonin, Oleg. Life after Trim: Using Factory Access Mode for Imaging SSD Drives. ElcomSoft Blog, 2019.