I deleted a file I meant to shred first.
$ rm somefile
instead of
$ shred somefile
$ rm somefile
Is there a way to shred a file after 'rm'-ing it?
1 Answer
There is no way to properly securely erase a file with modern filesystems anymore, because the journal can still contain data and there is no reliable way to overwrite the journal.
You can try to disable journalling on the filesystem before deletion, but it won't do anything about data that may already be in the journal from writing the file and not erased. It's not entirely secure.
An ounce of prevention is a pound of cure; it's better to sidestep the issue of needing to shred the file entirely by encrypting your files using an encrypted volume to begin with. This sidesteps the need to actually shred your data, so long as you keep your key safe. In a pinch, you could just use dd to erase the entire volume securely by using a few passes of random data. If you don't want to use full-volume encryption, there is also file-level encryption in ext4 now.
-
4
-
1The first reference is to an article written by an economist and the second is to an article that uses broken links to back up it's claims. I'm not sure how the 'single pass with zeros is sufficient' conclusion is justified by these reference.– DristCommented Jul 29, 2016 at 16:27
-
If you open the file in overwrite mode before deleting it and fill it with random data to the size it was originally, does that replace the journal info?– jc__Commented Jul 29, 2016 at 17:42
-
1@Drist nice argumentum ad hominem, but you should analyze the facts provided there, combining them with what you studied during your degree in Computer Science (I assume you have one since you are so confident in combinatorics and information theory), not who wrote the piece. Moreover, the second link does not provide broken links at all. It is a snapshot taken through the WayBack Machine but you can clearly see the original link to this paper. Commented Jan 7, 2017 at 0:45
-
@Andrea Lazzarotto - I didn't mean to be inflammatory, it might be that I'm picky about my facts. I apologize for inciting you. I think there's a distinction to be made here though. Suppose a single pass overwrite is sufficient to hide the previous state of the physical domains containing the data. IF an analyst can get at older copies of the file that were written to different physical domains, it might not matter at all if you overwrote the most recent iteration of the file.– DristCommented Jan 9, 2017 at 19:34
shredis pretty ineffective these days. Most filesystems have journals, and shread will not clean that. If you are using a journaled filesystem there is pretty much no security advantage in shred.zerofill? The journal might still be a problem, though.