Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

man shred warns that the command is not useful on file systems that don't overwrite in-place. I don't have much knowledge about the current and upcoming file systems, but I would suspect that many of them support some special in-place write mode for this purpose, which is used by shred.

Am I right with this assumption? Is it already implemented in shred? Is there some way of telling without too much trouble (e.g. when a new file system is announced)?

share|improve this question
    
Note that if you are using an SSD drive, it is impossible to overwrite specific physical sectors on it. shred has no value there regardless of filesystem used. –  liori Oct 24 '12 at 20:50
add comment

3 Answers

up vote 3 down vote accepted

shred is mostly useless. In order to remove the content of a deleted file from the disk image, it isn't enough to overwrite the places where the file was: you need to remove all copies of the file. It's not just a matter of the file having been overwritten in place. With many types of files, there can be multiple files with mostly the same content, because the file was edited and there are deleted backup copies left around.

Additionally, if the disk becomes damaged, it may be impossible to read the data by software means, but still possible to recover it by hardware means, or by letting the disk cool down (putting a hard disk in a freezer makes it less error-prone for a little while, until it finally gives up the ghost).

The safe way to shred a file is to store it from the start inside an encrypted container protected by a strong password (generate a long enough, random password, and write it down; when you're finished with the file, burn the piece of paper).

share|improve this answer
add comment

Tradicional linux filesystems (ext2/3/4) already overwrite in place. Doing so in btrfs/ZFS is next to impossible.

I can find no reference about files being overwritten in-place on UFS but my guess is that, being an older filesystem, they are.

So I guess the answer is: No, it is assuming too much. Some filesystems won't support (or don't support, currently) overwriting in-place.

If you're dealing with a unknown filesystem, solo's suggestion of encrypting sensitive data is probably worth considering. Elaborating on liori's comment - if the encrypted data is on a SSD, you won't be able to erase the stored key easily from the physical disk. It rewrites the logical sector, though, so an attacker would have to be able to develop custom firmware for the SSD to have any hope of recovering the data.

share|improve this answer
    
FWIW you can actually disable Copy-on-Write on Linux using file attributes. It works on most filesystems I've seen. –  Joel Davis yesterday
add comment

Without too much trouble, probably not. You can use the dd command to examine the space on disk where your file was, but even that is tricky to do in a filesystem independent way.

I would say, perhaps a more effective approach is to not use shred but to encrypt your data. Instead of destroying the data, you could simply destroy the key.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.