I am leaving my company. I have been asked to leave my company laptop and a password to access it. What should i log out of

Question

I have been asked to leave my company laptop with a password(which I will change and share) to access it.

The reasons for this have been explained to me and are invalid, alas.

I am going to assume this is legal in the UK. If not tell me and i'll wipe it immediately. But this question isn't about the legality of the situation.

I am a developer, therefore I have lots of accounts(github etc) logged in from various different sources.

I just want to check if there is anything else I should remove before handing it over.

I use a mac so there are a few mac specific things.

• Reset all browsers saved passwords. Chrome, Firefox and Safari
• Clear all history of these browsers
• Remove everything from Keychain.
• Cleared bash history.
• Revoked access on a few apps that use oauth with this machine. Is there something I can do to remove all of them?
• Calendar
• Downloads folder + any other items(a p60 from the job previous to this one was in one of the folders).
• Contacts
• Any and all programs that are no longer required.
• Any emails.
• Reminders
• I searched for some colleagues names and it brought up other files hidden away in caches.
• Notes

Is there anything I am missing?

I would like to add this was communicated to me about 4 hours ago. I have been working on this since then. Its now 7:30 in the UK on my last day in the office.

@AndréBorie The question wasn't really about the legality of the situation. That was more a stab in the dark. I have updated the question to reflect this. Deleting my user account would also delete all the stuff I have worked on. My reasons for wanting to fully wipe it are two fold.

1. The last time I left a machine in this state they expected it was used maliciously, including posts on stackoverflow.

2. A person this machine is being handed to has in the past also done similar things in point 1, bearing in mind he was the CTO. This included watching my password, allowing remote access then playing sounds through the terminal.

Answer 1

Legal matters depend a lot on jurisdiction (i.e. country, state/province for federal countries, professional branch in some cases...). However, in most of them, there is an official tolerance for using company hardware for limited personal use. E.g. if you have an office phone and use it to call your wife (or husband or whatever) that you will be late this evening, then you are not doing anything wrong. The same applies to accessing personal emails from a company laptop.

Doing so does not entitle the company access to whatever personal data remains on the machine. From the company point of view, personal data on a company machine is a minefield: if they access it, or let it leak to the next hardware owner, then you might be entitled to compensation. Thus, wiping the machine is the only sane advisable option for the company. If they not only intend not to wipe the machine but forbid you from doing so as well, then this means that one or several of the following may hold:

1. They are digging their own legal tombs.
2. They intend to read your personal data.
3. They have so sloppy procedures that they allow employees to keep critical business data on laptops without proper backups.
4. They don't understand the notion of "wiping".

In all probability, they just want to avoid the case where the former employee leaves the machine locked with an unknown password, and they don't know how to recover from that. This can be a problem in case of a BIOS (OpenFirmware in this case) password.

---

That being said, an OS X machine is, internally, a Unix system, so most if not all of your data should be in your user account directory. You could create a new user account (with administrative access), destroy the previous one, and ensure that the whole directory is gone for good. Don't forget to empty the trash can.

If that operation would count as "wiping" in the eyes of your inflexible future-ex-management, then you could limit yourself to deleting some specific sub-directories. Command-line access should show everything.

Answer 2

This is actually a common practice. While I cannot answer the legality I can offer some insight in to the why.

Assuming no malice, the company is requesting property back with a password they know so that once you leave, they can reference any information that is on the laptop. This is not an intention of not trusting you, but acknowledging that people do forget to document things because we are human. After a period time, usually a couple of weeks, they will wipe it.

I would doubt they are concerned with your personal data. But to safeguard yourself, change your passwords.

Answer 3

In addition to the other excellent answers, please note that whatever you "delete" by usual means (rm, empty trash, etc) will not be really deleted and can be recovered using the right tools.

The correct way to wipe everything would be to either use the ATA Secure Erase command on the drive, or overwrite it multiple times, but since you need to give them the machine in working order the best you can do is to overwrite all free space with random data multiple times.

Also note that if they have administrative access to the machine before, or if the machine was configured to back up to a server they control, they may already have exfiltrated all of your files. I suggest you change your passwords just to be safe, and revoke any certificates you may have kept on that machine.