Finder must be set to always empty Trash securely.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-59723	AOSX-10-001075	SV-74153r2_rule		Low

Description
Finder must be configured to always empty Trash securely in order to prevent data recovery tools from accessing the deleted files. Files emptied from the Trash by normal means are still present on the hard drive and can be recovered up until the moment the system overwrites that particular location on disk. A malicious user with physical access to a system could take advantage of this property to access potentially sensitive files that the normal system owner or user assumed was safely deleted. Configuring Finder to always empty trash securely mitigates this risk.

Description

Finder must be configured to always empty Trash securely in order to prevent data recovery tools from accessing the deleted files. Files emptied from the Trash by normal means are still present on the hard drive and can be recovered up until the moment the system overwrites that particular location on disk. A malicious user with physical access to a system could take advantage of this property to access potentially sensitive files that the normal system owner or user assumed was safely deleted. Configuring Finder to always empty trash securely mitigates this risk.

STIG	Date
Apple OS X 10.10 (Yosemite) Workstation Security Technical Implementation Guide	2017-04-06

Details

Check Text ( C-60493r1_chk )
To check that the finder will only present the option to securely empty trash run the following command as the primary user: system_profiler SPConfigurationProfileDataType \| grep EmptyTrashSecurely If 'EmptyTrashSecurely' is not set to '1' or there is no result, this is a finding.

Fix Text (F-65133r2_fix)
This setting is enforced using the "Custom Policy" configuration profile.