macOS · Secure Deletion
Emptying the Trash
deletes a name.
The file's contents stay on the disk, byte for byte, until something else happens to need that space. Recovering them takes free software and no expertise. Apple used to ship a Secure Empty Trash for this and removed it — not because the problem went away, but because the honest answer got more complicated.
Free to try, no account required.
What actually happens when you delete
The data is untouched
The filesystem marks the record unused and the blocks free. Your bytes are exactly where they were, which is precisely why deleting is instant — nothing was written.
APFS is copy-on-write, so overwriting is not what it sounds like
Writing new bytes over a file can put them in fresh blocks and leave the old ones intact and reachable. This is why Apple removed Secure Empty Trash and the srm command rather than quietly leaving them to under-deliver. Any Mac tool that promises unrecoverability without mentioning this is promising something the filesystem does not offer.
SSD wear levelling decides where writes land
The controller maps logical blocks to physical cells and keeps spare capacity your Mac cannot address. Overwriting a logical block does not necessarily erase the flash page holding the old contents — only TRIM, plus the controller’s own garbage collection on its own schedule, does that.
Snapshots and backups keep their own copies
Time Machine local snapshots and APFS snapshots hold whole prior versions of a file that nothing done to the original will touch. A document deleted today can sit in yesterday’s snapshot, complete.
What VaultSort actually does
A claim narrow enough to be true
The bytes at the file’s logical offsets are overwritten and flushed to the device, the name is destroyed before the entry is unlinked, and the entry is then removed. That is the guarantee, stated exactly, and it is carried out to the report rather than rounded up in the interface.
The name goes before the file does
Filenames survive in directory structures and indexes long after contents are gone, and a filename is often the sensitive part. Obfuscating it before unlinking closes that.
Pass counts you choose, with the truth about them
Standard is three passes and paranoid is seven, with anything up to thirty-five available. On modern hardware one is enough; the higher counts exist for people held to a standard that names a number, not because thirty-five is safer than one.
Free-space overwriting
Fills unallocated space so files deleted long before VaultSort was installed cannot be recovered from what was left behind. This is the one that addresses your history rather than one file.
Protected paths are refused, loudly
System locations are blocked outright, and a directory containing something it will not touch is reported as such rather than half-deleted and called done. Refusals are the feature — a tool that overstates what it did is worse than no tool, because you stop being careful.
Whole-disk erase, when the drive is leaving
For a device being sold or retired, erasing the whole drive is the complete answer where per-file deletion is the partial one. Progress is reported in real bytes.
What it does not do yet
- — On APFS, and on any copy-on-write filesystem, overwriting a file in place cannot guarantee the original blocks were reused. Where that matters, encrypt the file from the start, or erase the whole volume — those are the two approaches the filesystem actually supports.
- — Local snapshots are not touched. Deleting a file securely while an APFS or Time Machine snapshot holds a copy of it removes one of two copies. Thin the snapshots first if the history is what you need gone.
- — TRIM cannot be invoked per volume on macOS. There is no equivalent an application can call, unlike on Windows — so on an SSD, encryption and whole-disk erase carry more weight here than pass counts do.
- — Files in the cloud are not reached. A file removed locally may still exist in an iCloud, Dropbox or Google Drive version history that no local tool can see.
Questions people ask
Why did Apple remove Secure Empty Trash?
Because it could no longer guarantee what its name promised. On SSDs and copy-on-write filesystems, overwriting a file does not reliably overwrite the cells holding it. Removing the feature was more honest than leaving a button that quietly under-delivered — and it is the same reasoning behind the narrow claim above.
So is secure deletion pointless on a Mac?
No — it defeats every casual and most non-forensic recovery, which is the realistic threat for a sold laptop, a returned work machine or a shared computer. It is not a guarantee against a funded forensic effort on flash storage, and nothing operating at the file level is.
How many passes should I use?
One, unless a standard you are held to says otherwise. The multi-pass advice traces to a 1996 paper about encoding schemes that no longer exist, and its author has said it no longer applies. Seven passes on an SSD is mostly seven times the wear.
What is the strongest thing I can actually do?
Encrypt sensitive files from the moment they exist, so that deleting the key is what matters rather than deleting the bytes. Then, when the machine leaves, erase the whole drive. Per-file secure deletion is the right tool for what you did not encrypt in time.
Try it on your own files
One purchase, no subscription. $24.99 once, and every feature is included.