784      iPhone_iPad_Mac_apple

Unauthorized partition on my internal hard

As a result of an MITM attack a portion of my internal hard drive has been created that I cannot access or even delete when wiping the drive and starting from scratch.  Any solutions that would ensure a complete wipe?  Even wiping at the highest (7) level doesn't help...I don't have permissions to do this.  This is my own personal MacBook Air in which I'm the only user.  I assume this is simply to safeguard me accessing their own IT Policy and perhaps malware programs.

Can you post the output from

Applications -> Utilities -> Terminal -> diskutil list

If you need to obscure disk names, that is OK.  For example, this is from my Mac

diskutil list

/dev/disk0 (internal):

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                         1.0 TB     disk0

   1:                        EFI EFI                     314.6 MB   disk0s1

   2:          Apple_CoreStorage <hiding_the_name>          950.2 GB   disk0s2

   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

   4:                  Apple_HFS macOS10.12              49.2 GB    disk0s4

 

/dev/disk1 (internal, virtual):

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:                            <hiding_the_name>         +949.9 GB   disk1

                                 Logical Volume on disk0s2

                                 EB04EA42-A7F4-4301-B7C4-C1B19B4E4C05

                                 Unlocked Encrypted

First of all thank you for responding so quickly!  I did not get notified of your response so I apologize for that.

LIST

/dev/disk0 (internal, physical):

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                        *121.3 GB   disk0

   1:                        EFI EFI                     209.7 MB   disk0s1

   2:          Apple_CoreStorage Untitled                120.5 GB   disk0s2

   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

/dev/disk1 (internal, virtual):

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:                  Apple_HFS Untitled               +120.1 GB   disk1

                                 Logical Volume on disk0s2

                                 1E4691A3-9CFC-43D7-BBAE-4B5F90B7F59C

                                 Unlocked Encrypted

/dev/disk2 (disk image):

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:     Apple_partition_scheme                        +193.1 MB   disk2

   1:        Apple_partition_map                         32.3 KB    disk2s1

   2:                  Apple_HFS Firefox                 193.0 MB   disk2s2

I'm not sure if the info you're looking for is going to show up since I don't have privileges. If it doesn't and there's another area I can check, let me know.  I will look in the meantime as well.

From a disk partition perspective, all of your physical disk's storage is accounted for, and what I would expect.

If you have a portion of your disk that you cannot access, it is not at the physical disk level.

Can you identify what it is that you cannot access?

Depending on which version of the operating system you are running, there are operating system specific files that are protected from being deleted or modified by the user.

As a result of an MITM attack a portion of my internal hard drive has been created that I cannot access or even delete when wiping the drive and starting from scratch.

How are you going about this?  You cannot reformat the drive when you are booted from the drive.

You need to boot with the recovery partition to reformat the startup partition  Even booted from the recovery partition, you may not be able to reformat the whole drive.  I have not tried.

command + r

You may be able to erase the whole drive when

command + option + r

I do not know.

Sorry for the late response my MBA was not useable since March and I just got it back from a consultant that I paid to wipe it. I was also not able to find my own discussion with my iOS devices...everything is working well and I'm not using WiFi (all my devices connect via Ethernet or use Cellular).

To answer your question it was the first disk 209 MB that I could not access (did not have permissions). I have had a history I believe of having a rogue IT Policy being installed in an inaccessible partition dating back almost 5 years now even on my Windows Computers.

最后更新：2017-10-16 09:09:10

  上一篇： Terminal does not work

  下一篇： How do I remove Facebook plugin from MacOS X sa...