Securely Delete Files.
No Recovery Possible.

The APFS Copy-on-Write Problem

On modern Macs with APFS (Apple File System) and SSD storage, file shredding has a fundamental limitation that most shredder apps don't tell you about, but CleanMachine does.

APFS uses copy-on-write semantics: when you modify a file, the new data is written to a different location on the SSD, and the old location is marked as free. This means even if CleanMachine overwrites a file's current location, the previous version may still exist at the old physical location.

Also, SSDs use wear-leveling technology to distribute writes across the NAND flash. This means the OS doesn't have direct control over which physical cells receive which writes, making it impossible to guarantee that an overwrite reaches the original NAND cell containing the sensitive data.

When File Shredding Still Makes Sense

For most realistic threat models, CleanMachine's shredder is effective:

• Selling or donating a Mac (use Erase All Content and Settings instead, more thorough)
• Deleting files from a machine before someone else uses it temporarily
• Removing sensitive files when you're confident previous versions don't need protection
• Compliance with basic data security policies that require overwrite-before-delete

When FileVault Is the Real Answer

For true forensic resistance, FileVault full-disk encryption is far more effective than file shredding on APFS/SSD. When FileVault is enabled:

• All data on disk is encrypted with your password
• Even if NAND cells are physically read, the data is unintelligible without the key
• When you erase an encrypted volume, destroying the key makes all data irrecoverable instantly

CleanMachine's FileVault view checks your encryption status and opens directly to the FileVault settings pane if it's off.

The 3-Pass and 7-Pass Options

3-Pass: zeros → random data → zeros. Fast and sufficient for most use cases. Works well on mechanical hard drives (where it is effective) and provides a reasonable layer of protection on SSDs against basic recovery tools.

7-Pass DOD: follows the DoD 5220.22-M standard with 7 passes of alternating data patterns. Slower and causes more SSD wear, appropriate for high-sensitivity compliance scenarios.