3

I have been asked to leave my company laptop with a password(which I will change and share) to access it.

The reasons for this have been explained to me and are invalid, alas.

I am going to assume this is legal in the UK. If not tell me and i'll wipe it immediately. But this question isn't about the legality of the situation.

I am a developer, therefore I have lots of accounts(github etc) logged in from various different sources.

I just want to check if there is anything else I should remove before handing it over.

I use a mac so there are a few mac specific things.

  • Reset all browsers saved passwords. Chrome, Firefox and Safari
  • Clear all history of these browsers
  • Remove everything from Keychain.
  • Cleared bash history.
  • Revoked access on a few apps that use oauth with this machine. Is there something I can do to remove all of them?
  • Calendar
  • Downloads folder + any other items(a p60 from the job previous to this one was in one of the folders).
  • Contacts
  • Any and all programs that are no longer required.
  • Any emails.
  • Reminders
  • I searched for some colleagues names and it brought up other files hidden away in caches.
  • Notes

Is there anything I am missing?

I would like to add this was communicated to me about 4 hours ago. I have been working on this since then. Its now 7:30 in the UK on my last day in the office.

@AndréBorie The question wasn't really about the legality of the situation. That was more a stab in the dark. I have updated the question to reflect this. Deleting my user account would also delete all the stuff I have worked on. My reasons for wanting to fully wipe it are two fold.

  1. The last time I left a machine in this state they expected it was used maliciously, including posts on stackoverflow.

  2. A person this machine is being handed to has in the past also done similar things in point 1, bearing in mind he was the CTO. This included watching my password, allowing remote access then playing sounds through the terminal.

  • 1
    Why not just reset the password to any personal accounts? – user2320464 Aug 4 '16 at 18:17
  • 3
    I am not aware of the legal issues in your country. But if you have personal data on the laptop, which you should not have, if it is the company laptop. But anyway, you can simply backup anything that is related to your work, which is most likely already backed up, but let us assume it is not. Then, wipe the laptop, and put back your company files and back on it and hand it over to the company. – Ubaidah Aug 4 '16 at 18:19
  • @user2320464 this i have done. But some are not done with a simple username and password. Some are linked to the machine accessing them through other means. – DickieBoy Aug 4 '16 at 18:21
  • 2
    The laptop is company property, so they have a right to it and to all the data that's on it - it is your fault for bringing personal data to it. However, can you talk to the IT department and ask whether you can just reinstall the laptop (or have them do it in front of you)? Maybe that's what they would do anyway and the "leave your password" was just a misunderstanding from management who may not be aware how the IT department handles those cases. If not, ask them whether you can delete your user account and create a new one. That should delete everything. – André Borie Aug 4 '16 at 18:23
  • 1
    @AndréBorie i have no problem with leaving the laptop. You are correct in saying that there shouldn't be any. But there is some crossover between work and personal, such as doctors notes which I have had to provide for absences and complaints about employees all of which I would not trust in the hands of the people this machine is being handed to. Management have said that wiping the machine is out of the question. – DickieBoy Aug 4 '16 at 18:32
3

Legal matters depend a lot on jurisdiction (i.e. country, state/province for federal countries, professional branch in some cases...). However, in most of them, there is an official tolerance for using company hardware for limited personal use. E.g. if you have an office phone and use it to call your wife (or husband or whatever) that you will be late this evening, then you are not doing anything wrong. The same applies to accessing personal emails from a company laptop.

Doing so does not entitle the company access to whatever personal data remains on the machine. From the company point of view, personal data on a company machine is a minefield: if they access it, or let it leak to the next hardware owner, then you might be entitled to compensation. Thus, wiping the machine is the only sane advisable option for the company. If they not only intend not to wipe the machine but forbid you from doing so as well, then this means that one or several of the following may hold:

  1. They are digging their own legal tombs.
  2. They intend to read your personal data.
  3. They have so sloppy procedures that they allow employees to keep critical business data on laptops without proper backups.
  4. They don't understand the notion of "wiping".

In all probability, they just want to avoid the case where the former employee leaves the machine locked with an unknown password, and they don't know how to recover from that. This can be a problem in case of a BIOS (OpenFirmware in this case) password.


That being said, an OS X machine is, internally, a Unix system, so most if not all of your data should be in your user account directory. You could create a new user account (with administrative access), destroy the previous one, and ensure that the whole directory is gone for good. Don't forget to empty the trash can.

If that operation would count as "wiping" in the eyes of your inflexible future-ex-management, then you could limit yourself to deleting some specific sub-directories. Command-line access should show everything.

| improve this answer | |
  • Thanks for the answer. I don't think that is the case. In all honesty I believe the people i am handing it over to are just being difficult. We have a past history professionally which didn't end well for the comapny. They were also brought on without my knowledge(one of the main reasons i am leaving). I think ill have to do my best to just delete everything I possibly can. – DickieBoy Aug 4 '16 at 18:48
  • Whatever you delete is not really deleted unless you also overwrite the free space several times, otherwise it may be recovered. – André Borie Aug 4 '16 at 18:51
  • @AndréBorie I saw that in a comment I cant seem to find any more, im running the free space deleter as we speak. I think i have removed everything i possibly can. Could you post that as an answer. – DickieBoy Aug 4 '16 at 18:54
  • @AndréBorie: in fact, if they really want to recover some data, then it is quite hard to really wipe it all, especially in the case of a SSD. If the company is assumed to be that hostile, then the only "reasonable" course of action is to physically destroy the machine (with fire) and accepting having to pay the hardware cost. On the other hand, if we assume that they won't try that bad, then deleting files and filling the free space once should be sufficient (it will remove all traces available without extracting the chips from the case). – Thomas Pornin Aug 4 '16 at 19:01
  • 1
    @ThomasPornin recovering the data from the memory chips themselves would require understanding and reimplementing the SSD controller's wear-leveling algorithm to be able to read the data and "go back in time" to know which NAND block mapped to which SATA sector at a particular time. It would require so much work I'm not even sure law enforcement would do it unless it's really important. – André Borie Aug 4 '16 at 19:07
2

This is actually a common practice. While I cannot answer the legality I can offer some insight in to the why.

Assuming no malice, the company is requesting property back with a password they know so that once you leave, they can reference any information that is on the laptop. This is not an intention of not trusting you, but acknowledging that people do forget to document things because we are human. After a period time, usually a couple of weeks, they will wipe it.

I would doubt they are concerned with your personal data. But to safeguard yourself, change your passwords.

| improve this answer | |
1

In addition to the other excellent answers, please note that whatever you "delete" by usual means (rm, empty trash, etc) will not be really deleted and can be recovered using the right tools.

The correct way to wipe everything would be to either use the ATA Secure Erase command on the drive, or overwrite it multiple times, but since you need to give them the machine in working order the best you can do is to overwrite all free space with random data multiple times.

Also note that if they have administrative access to the machine before, or if the machine was configured to back up to a server they control, they may already have exfiltrated all of your files. I suggest you change your passwords just to be safe, and revoke any certificates you may have kept on that machine.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.