Should I use:
find / -type f -exec shred -uvz -nX
or just good old
dd if=/dev/urandom of=/dev/sda
Is one faster or more secure than the other?
However, the effectiveness of
If you are trying to overwrite data beyond any recovery, then, a simple
If you are just trying to make it really, really, really hard, then don't bother with urandom, and just use /dev/zero
The cost of a new drive is probably less than the cost of more secure wipes, and, thus, the hammer is the right solution from that point on.
Update: Shred is pointless.
From the documentation for shred, it has a number of limitations:
You can throw in ext4 for that (which has journaling on by default).
Also, shred on your individual files will not go as far as removing all the relevant metadata from the file., You may have other hard-links, etc. pointing to the same inodes, and the metadata will still exist. Sometimes even knowing the existance of a file is a security problem.
Back to the hammer.....
Another option I just read about yesterday:
Of course, you can replace
This should be faster than having the kernel give you random data.
You can also do this with
The advice to repeatedly overwrite with random data rather than zeroes is something that was true for the disk technologies of 20 years ago — and even then, overwriting with zeros worked pretty well. With modern hard disks, overwriting with zeros is sufficient. See Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?.
SSD is a more recent technology than hard disks and less is known about its remanence after writes. There are to my knowledge no public reports of recovering data overwritten with zeros on any flash technology (I can't speak for government agencies — but they probably have your data already anyway). You may want to watch Secure wiping of EEPROM and flash memory for updates.
There is an added wrinkle on flash technologies that reallocate sectors (such as SSD drives): after overwriting the whole surface in software, there are sectors which are currently not mapped and still have their own content. These sectors cannot be read using the normal interface but might be read by probing inside the storage device. (As far as I know, this is a known technique, but ranges from moderately pricy to very expensive depending on the flash storage device model). To fully erase a flash drive, in principle, you need to issue a secure erase command; however [many devices do not implement this command correctly](ATA security erase on SSD), so always do a software wipe first.