The Illusion of “Emptying the Trash”
When you delete a file on macOS and empty the Trash, the operating system does not actually destroy the data. It simply deletes the “pointer” to that file, telling the hard drive, “You can use this space for something else later.” Until that physical sector of the drive is overwritten with new data, the original file remains fully intact and can be easily recovered using inexpensive forensic software.
If you are selling an old Mac, returning a corporate laptop, or disposing of an external hard drive that contained sensitive financial documents, a standard format is not enough. You must perform a Secure Erase.
While the graphical Disk Utility app used to offer a “Security Options” slider, Apple has increasingly hidden this feature, especially on newer macOS versions. The most reliable way to securely wipe a drive is by using the diskutil command in the Terminal.
Understanding Solid State Drives (SSDs) vs. Hard Disk Drives (HDDs)
CRITICAL WARNING: The commands in this article are designed for traditional, spinning magnetic Hard Disk Drives (HDDs) and older USB flash drives.
Modern Macs use Solid State Drives (SSDs). SSDs use “wear-leveling” algorithms that constantly move data around to prevent specific memory chips from burning out. Because of this, attempting a multi-pass secure erase on an SSD is both highly ineffective and severely damaging to the lifespan of the drive.
To securely erase a modern Mac with a built-in SSD: You do not need the terminal. The internal SSD is hardware-encrypted by the T2 chip or Apple Silicon (M1/M2/M3). To securely erase it, you simply use the “Erase All Content and Settings” feature in System Settings. This cryptographically destroys the decryption keys, rendering the data instantly and permanently unreadable.
Use the terminal commands below ONLY for external mechanical hard drives, old thumb drives, or legacy Macs with spinning disks.
Step 1: Identify the Target Drive
First, you must find the exact internal identifier for the external drive you want to wipe. Open the Terminal and type:
diskutil listThis will display a list of all connected drives. Look carefully at the sizes and names to identify your external drive. It will be labeled something like /dev/disk2 or /dev/disk3.
Double-check this identifier. If you select the wrong disk (like /dev/disk0, which is usually your main operating system), you will destroy your computer.
Step 2: Choose Your Erase Level
The diskutil secureErase command offers several levels of security, ranging from a quick single-pass wipe to a paranoid, military-grade overwrite.
The syntax is: diskutil secureErase [Level] [Drive Identifier]
Level 0: Single-Pass Zero Fill
This is the recommended balance of speed and security. It writes zeros over every single sector of the drive one time. It prevents all consumer-grade recovery software from finding data.
diskutil secureErase 0 /dev/disk2Level 1: Single-Pass Random Fill
Slightly more secure than zeros, this writes a layer of completely randomized cryptographic noise over the drive.
diskutil secureErase 1 /dev/disk2Level 2: The 7-Pass (DoD Standard)
This executes the US Department of Defense (DoD) 5220.22-M standard. It writes over the entire drive seven times. This is incredibly secure, but it will take many hours (or days) to complete on a large mechanical drive.
diskutil secureErase 2 /dev/disk2Level 3: The 35-Pass (Gutmann Algorithm)
This executes 35 passes of randomized data. It is widely considered overkill in modern computing and will take a massive amount of time, but it represents the maximum possible destruction of magnetic data.
diskutil secureErase 3 /dev/disk2Conclusion
While hardware encryption has made secure erasure instantaneous on modern internal SSDs, legacy magnetic media still requires brute-force data destruction. By leveraging the diskutil secureErase command, you can guarantee that any external hard drive leaving your possession is fundamentally unrecoverable.