Securely erasing a drive will overwrite the contents of the device to insure that no data can be recovered. This process involves overwriting every block of data on the drive one or more times to insure that no trace of the previous information on the device remains. Simply deleting the data on a drive does not actually erase it but rather only frees that space to be overwritten by new data.
Before imaging a suspect device to a target drive it is necessary for the investigator to first wipe the existing data on the target drive. This insures that the target drive is free of any information from previous investigations and insures the integrity of the suspect evidence. Clearing the target drive can be done either using Apple Disk Utility or MacForensicsLab.
Using Apple Disk Utility to erase your target drive
To clear the acquisition drive using Apple Disk Utility, first open the Mac's hard drive and locate the Applications folder and open it.
Find and open the Utilities folder and open it.
Locate and open the application Disk Utility.
First select the target drive you wish to wipe by clicking it on the left side. Next click the "Erase" toolbar option at the top of the window. Finally click the Security Options... button at the bottom of the window. If you would like, give the drive a name by entering it in the name area.
In the Secure Erase Options the investigator can then select the desired method of erasing. Then click OK.
Click the Erase button to start erasing the target drive. A progress bar will indicate the status of the device erasure.
Using MacForensicsLab to erase your target drive
First select the target drive you would like to erase in the Device area of MacForensicsLab in the upper left corner.
With the desired device selected, go to the File menu and select Clear Work Drive.
Select the number of passes you would like to make when erasing the data on your target drive. This can be done by either using the slider or entering the desired number in the box. When you have set the desired number of passes, click the Start button.
MacForensicsLab will inform you that the operation cannot be undone. Make sure you have selected the correct device and then click the OK button.
The shred process will begin and a status window will show the current progress of the task. When the device has been erased the software will notify the user that the process has completed.
