privacy

If you believe someone is getting into your online accounts, you should reset your passwords and set up multi-factor authentication (MFA) for each online account. This ensures that no one except you can access your accounts, even if your password is stolen.

To truly reset your Mac and erase all data, complete the steps below. If your Mac has an Intel processor, these steps will only work in macOS Catalina or later.

1. Enable FileVault in System Preferences -> Security and Privacy, and wait for encryption to complete. You may need to plug your Mac in to power.
2. If you're prompted for an administrator password, skip to step 5.
3. At the top of the screen, select Utilities -> Terminal.
4. Type "resetpassword" without the quotes and hit Enter (Return).
5. At the top of the screen, select Recovery Assistant -> Erase Mac.
6. Follow the onscreen instructions to erase your Mac and reactivate it. Then, reinstall macOS.

Thanks for posting the output for your internal drive. It looks like the Mac was improperly erased several times. If you erased it using Disk Utility, be sure to erase the volume group, and not just the individual volume, when you erase Macintosh HD or Macintosh HD - Data. Also, delete any other volumes present.

Hi mav292,

Can you please explain your question further? I'm not sure what you mean by someone controlling the results you see. Thanks for posting the EtreCheck report though.

I'm seeing a lot of orphaned Data volumes on your Mac... did you attempt to erase and reinstall macOS several times?

Please complete the steps below to help identify which data volume is the current one and which ones are orphaned:

1. Open Terminal, located in Applications -> Utilities.
2. Type this command and hit Enter (Return): diskutil apfs listvolumegroups
3. Post the output here.

mav292 wrote:

Tell me if you know what This is , I just don't know if its normal or if that means there is some extra containers doing something at the same time that I don know about. Are you able to see the pictures? I couldn't take screen shots.

…Or Apple’s instructions for how to: Erase and reinstall macOS - Apple Support

Usual security problems that folks get into are with weak passwords, routinely with password re-use problems, with no two-factor authentication (two factor is a last line of defense for an exposed password), and with phishing.

Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support

Apple has customized security recommendations available that can help improve your security, too.

For detected password issues and recommendations In macOS Safari, Safari > Preferences > Passwords > look for the ⚠️

Way more security info: Apple Platform Security - Apple Support

EDIT: I forgot the most important step in the erase process: after you enable FileVault, start up in macOS Recovery. Then proceed with steps 2-5.

How to start up in macOS Recovery:

On an Intel-based Mac: restart while holding down Command-R. Release the keys when the Apple logo and a progress bar appear.

On a Mac with Apple silicon: Shut down the Mac, then press and hold the power button until the message “Loading startup options” appears. Then, select Options and click Continue.

mav292 wrote:

If I have 1 saying "MacOS SSD " then several other under it saying "MacOS SSD-data" I usually just erase the first one . I know I'm supposed to keep one of them that ends in "-data" how do I identify the one I keep ? what is all included in the volume group? I don't want to delete the wrong thing...

When you erase MacOS SSD, you should click Erase Volume Group in the prompt. This will erase the system volume and delete the associated data volume entirely.

You should not keep any volumes ending in Data when you're trying to erase your Mac. Instead, delete (not erase) all of them. In fact, keeping the Data volume(s) behind can cause issues when trying to erase and reinstall macOS on a Mac with Apple silicon (M1 and future).

When you reinstall macOS, the installer takes the volume you select (ideally MacOS SSD), appends " - Data" to its name, and turns it into a Data volume. It then creates a second volume silently, and marks it as the corresponding System volume. Any other volumes, including previous Data volumes, are left behind as clutter.

Thanks for uploading those pictures!

Erase Container disk3, just below the Apple SSD. Choose these options:

Name: Macintosh HD

Format: APFS

Erasing the container will delete all volumes inside, including the current macOS installation and all of the orphaned Data volumes. It will then create a new empty APFS volume that can be used by the macOS installer.

EDIT: If you're wondering why there are several "parent" entries of "macOS SSD - Data", those are all orphaned Data volumes that used to be part of their own volume groups (consisting of a system volume and a data volume). They can all be deleted.

Is it new or used? If used, you may be seeing a lot of "garbage" you can remove.

Maybe try uploading the image to elsewhere (such as Imgur) and linking to it here?

The Apple disk image that appears in Disk Utility is the image containing macOS Recovery. Leave it (and its sub-entries) as it is.

At this point, you should be able to reinstall macOS successfully.