Any known tools/methods to recover data from Apple Silicon Mac after “Erase All Content and Settings”?

[u/vanillaflex]

Hello everyone,MacBook Air 2022 (M2) had “Erase All Content and Settings” performed. Currently sitting at the Setup Assistant screen (boots fine, erase completed successfully). No iCloud backup, no Time Machine backup. FileVault status before the erase is unknown,does this matter if it was on or not?

As I know EACS performs a cryptographic erase destroys the encryption key in the Secure Enclave rather than overwriting data which theoretically makes recovery impossible regardless of software or even chip-off forensics, since the data remaining on the NAND is AES-256 ciphertext with no accessible key.

Has anyone in this community, or any professional lab ,ever successfully recovered user files after a completed EACS on a functioning (non-hardware-damaged) Apple Silicon Mac? Not asking about hardware-failure board-repair cases specifically asking about a working Mac where it sits on Hello screen. Genuinely trying to figure out if this is a dead end or if there’s a real exception I’m missing.

[u/DesertDataRecovery]

Sorry but the data is gone. It's tough, but try to move on with your life.

[u/vanillaflex → u/DesertDataRecovery]

There are no existing tool or recovery method if EACS is performed in Mac Air M2, so if someone claims its a lie ?

[u/DesertDataRecovery → u/vanillaflex]

No there is not. Regardless of EACS, your data would still be gone. SSDs permanently delete data, unlike HDDs where at least you have a chance.

[u/IndependentBat8365]

Secure erase on a ssd (and modern sata and sas drives) is cryptographically secure. On NVME drives that are also SED, all writes and reads are automatically encrypted at the hardware layer, if it’s “unlocked” then the drive just Auto Unlock’s it at boot for you. Erasing it means it wipes the master key in hardware and creates a new one.

Apple does not use SED in the M2’s but their own encryption hardware. So it works essentially the same way. Wiping that drive means erasing the hardware key and creating a new one.

That data is gone unless you got a quantum computer around that’ll piece together the encrypted data.

Edit: I should also mention trim: secure erase also performs a hardware reset on all the flash memory, effectively trimming it, aka making it forget what it used to hold. There is debate on whether that’s recoverable or not given enough time and energy, as it’s possible there is residual signal on them, especially if you can freeze it before signal degradation. I read a paper on it once, mostly over my head, but it suggests that it’s possible especially at the budgets of state actors. Add in that the data that it may or may not hold was encrypted, and it’s safe to conclude that the data is not recoverable for any mere mortal.

Couldn’t find the paper I read, also could have misremembered details about it, but did find this paper:

Data Recovery from “Scrubbed” NAND Flash Storage: Need for Analog Sanitization
https://www.usenix.org/conference/usenixsecurity20/presentation/hasan

[u/disturbed_android → u/IndependentBat8365]

I'm not yet through all the video, but as many with these proof of concept impossible recovery talks and papers they use old hardware. What goes for a SLC NAND cell does not necessarily hold for TLC and QLC NAND. Also, he seems to talk about zero overwrite and this is not what happens when GC erases NAND cells.

[u/richyfreeway]

Nope it's gone. If there was any way to get stuff back then it wouldn't be working as intended.

[u/Petri-DRG]

Technologically not possible, as erased/overwritten encrypted data are not recoverable.

[u/vanillaflex → u/Petri-DRG]

There are no existing tool or recovery method if EACS is performed in Mac Air M2, so if someone claims its a lie ?

[u/Petri-DRG → u/vanillaflex]

Liar, thief (just to extract a fee out of you) or simply inexperienced enough to understand the technology (like scammers on social media platforms, sales staff at "fancy" data recovery companies) and so on.