Skip to content
FIN-CSIRT
RS

FIN-CSIRT / Search

What are you looking for?

Start typing to see results.
    Report an incident

    FIN-CSIRT / Practical lesson

    Prepare backups and protection for your Mac

    Find the system controls for your task. Before erasing, check your data, accounts and the supported procedure for your model.

    People using personal Mac computersAbout 5 minutes of reading + 3 questions
    Start with the example Your Mac is missing?

    What you will learn

    • Check macOS updates and a completed backup.
    • Start the official lost-computer procedure.
    • Recognise the requirements for erasing before handoff.

    Practice example

    The backup drive already holds important files

    Time Machine setup
    The backup drive already holds important files

    You connect a drive holding family photos. During backup setup, a prompt asks to erase that drive.

    Schematic example; confirming erasure is not a harmless way to continue.
    Show the example explanation
    Read the drive name
    Check which drive is selected for erasure.
    Protect existing files
    Do not confirm if it holds the only copy of your photos.
    Choose a prepared drive
    Use an empty drive or one specifically prepared for backups.

    Before you start

    The paths below use System Settings on newer macOS versions. Older versions call it System Preferences. Check your version and model in the Apple menu under About This Mac.

    Contact IT for an organisation-managed computer. If there is active unauthorised control or a ransom demand, disconnect network connections and follow device recovery. Do not attach a backup drive in that state.

    Make a Time Machine backup

    Time Machine is the Mac’s built-in backup feature. Prepare an empty or dedicated drive with enough space. If setup asks to erase a drive containing important data, stop until those files are saved elsewhere.

    1. Connect the prepared drive.
    2. Open Apple menu → System Settings → General → Time Machine.
    3. Choose Add Backup Disk, then check the selected drive name.
    4. Complete setup. If you enable Encrypt Backup, keep its password in a protected place outside that Mac.
    5. Wait for the first backup; use the Time Machine menu to check progress and the completion date. Back Up Now starts another backup immediately.

    Verify that important files are available in the backup before erasing originals. When finished, safely eject and disconnect the external drive when not in use. See the backup and ransomware guide for separate copies.

    Update macOS

    1. After checking your backup, open Apple menu → System Settings → General → Software Update.
    2. Review the offered update and start installation.
    3. Keep the computer powered until it finishes; do not close a laptop lid during installation.
    4. Check Software Update again afterwards.

    If the setting is missing, search Spotlight for Software Update. Offered versions depend on Mac compatibility. A message showing no updates does not prove that the computer has no malware.

    Prepare location features and respond to loss

    While you still have the Mac, look for Find My Mac under iCloud in Apple account settings. Check that it is enabled and the necessary location services are allowed. The setting’s position varies by macOS version.

    If the Mac goes missing:

    1. On another trusted device, open Find My or enter icloud.com/find.
    2. Select your Mac from the device list.
    3. Follow Lost Mode, or Lost Mac on the web, to lock the computer. Keep any code the process asks you to create.
    4. Check the completion status; commands may wait until the device connects.

    If Find My was not set up, you cannot enable it afterwards on the missing Mac. Protect exposed Apple and other accounts and report theft to police. Do not go to an unfamiliar map location yourself.

    Erase deletes data; it is not a lock command. Before remote erasure, check existing backups and warnings for that model. It will not create a new copy of the missing computer. For a stolen Mac, do not remove it from Find My at a stranger’s request.

    Erase before sale or handoff

    Do this on a Mac in your possession, only after checking your backup and account access from another device. Disconnect the backup drive.

    Erase All Content and Settings is supported on Macs with Apple silicon or an Apple T2 chip running macOS Monterey 12 or later. On macOS Ventura 13 and later, open System Settings → General → Transfer or Reset and choose that command. Review the summary of accounts, contents and settings being removed before confirming.

    Complete the process to the initial setup screen for a new user; do not sign back into your account. This removes your ownership association as part of handoff and is different from protecting a stolen Mac.

    If the option is missing, use the procedure for the exact model, which may involve macOS Recovery and reinstallation. Do not use random terminal commands. If you cannot confidently establish the procedure, seek specialist help before handoff. Also follow the device handoff checklist.

    Check your knowledge · 3

    Your turn to choose the next step.

    Choose one answer for each question shown. More complex lessons select three questions from a wider question bank when the lesson loads.

    Questions and explanations are also available without JavaScript.

    Time Machine asks to erase a drive holding your only photo copies. What do you do?

    Why does this matter? Preparing a backup drive can erase data already on it.

    1. Confirm because every backup preserves existing files too.

      An erasure warning means existing contents may be lost.

    2. Stop and choose a prepared drive, or save the photos elsewhere first.Correct answer

      You avoid sacrificing your only copy to make a new one.

    3. Rename the drive and confirm immediately.

      A new name does not change the effect of erasure.

    You enabled Encrypt Backup. What should you keep separately from the Mac?

    Why does this matter? Restoring an encrypted backup may require its separate password.

    1. Only a picture of the icon.

      An icon cannot unlock a backup.

    2. Only the monitor serial number.

      That information does not replace the password.

    3. The encrypted backup password, in a protected place.Correct answer

      If the Mac is lost, you still have the information needed for the backup.

    An older Mac lacks Erase All Content and Settings. What is a safe next step?

    Why does this matter? The procedure depends on the model and system version; one command is not universal.

    1. Check the official procedure for that model or get trusted specialist help.Correct answer

      This selects a supported process while retaining backup and account checks.

    2. Copy an erasure command from an unsolicited message.

      An unknown command may permanently erase the wrong drive.

    3. Delete a few visible files and hand over the computer.

      Accounts and other personal data may remain on the computer.

    No registration. Your answers are not sent; the result is just for you.

    Check what you erase and where you can restore from

    Verify the backup and its password first. A missing computer and a planned handoff require different procedures.

    Check your Apple account

    References

    Sources and further reading

    Apple documents Time Machine backups, macOS updates, lost Mac recovery and Mac erasure requirements and steps. Paths depend on the model and system version; they do not replace organisational rules for business data.

    Content last reviewed