Handing in macbook with root access - protecting data
To my knowledge, it is not easy to retrieve data deleted from an SSD. If TRIM is turned on (and it will be on a MacBook in most situations), there is no way for the operating system to retrieve the contents of a block that has been erased. Specialized forensic analysis software can read deleted blocks that have not yet been overwritten, but this is only possible with certain SSDs.
If you wanted to be very careful, I would suggest the following:
- Turn on FileVault and wait for the volume to be fully encrypted.
- Boot into recovery mode and erase the disk.
An article about recovering data from SSDs: Afonin, Oleg. Life after Trim: Using Factory Access Mode for Imaging SSD Drives. ElcomSoft Blog, 2019.