5

I deleted a file I meant to shred first.

$ rm somefile

instead of

$ shred somefile

$ rm somefile

Is there a way to shred a file after 'rm'-ing it?

  • 4
    shred is pretty ineffective these days. Most filesystems have journals, and shread will not clean that. If you are using a journaled filesystem there is pretty much no security advantage in shred. – grochmal Jul 26 '16 at 21:49
  • I didn't realize that. So I'll have to look up a secure delete method. – Drist Jul 26 '16 at 21:54
  • What about using zerofill? The journal might still be a problem, though. – Andrea Lazzarotto Jul 28 '16 at 11:59
8

There is no way to properly securely erase a file with modern filesystems anymore, because the journal can still contain data and there is no reliable way to overwrite the journal.

You can try to disable journalling on the filesystem before deletion, but it won't do anything about data that may already be in the journal from writing the file and not erased. It's not entirely secure.

An ounce of prevention is a pound of cure; it's better to sidestep the issue of needing to shred the file entirely by encrypting your files using an encrypted volume to begin with. This sidesteps the need to actually shred your data, so long as you keep your key safe. In a pinch, you could just use dd to erase the entire volume securely by using a few passes of random data. If you don't want to use full-volume encryption, there is also file-level encryption in ext4 now.

| improve this answer | |
  • 4
    «using a few passes of random data» A single pass with zeros is equally effective (1) (2). – Andrea Lazzarotto Jul 28 '16 at 11:57
  • 1
    The first reference is to an article written by an economist and the second is to an article that uses broken links to back up it's claims. I'm not sure how the 'single pass with zeros is sufficient' conclusion is justified by these reference. – Drist Jul 29 '16 at 16:27
  • If you open the file in overwrite mode before deleting it and fill it with random data to the size it was originally, does that replace the journal info? – jc__ Jul 29 '16 at 17:42
  • 1
    @Drist nice argumentum ad hominem, but you should analyze the facts provided there, combining them with what you studied during your degree in Computer Science (I assume you have one since you are so confident in combinatorics and information theory), not who wrote the piece. Moreover, the second link does not provide broken links at all. It is a snapshot taken through the WayBack Machine but you can clearly see the original link to this paper. – Andrea Lazzarotto Jan 7 '17 at 0:45
  • @Andrea Lazzarotto - I didn't mean to be inflammatory, it might be that I'm picky about my facts. I apologize for inciting you. I think there's a distinction to be made here though. Suppose a single pass overwrite is sufficient to hide the previous state of the physical domains containing the data. IF an analyst can get at older copies of the file that were written to different physical domains, it might not matter at all if you overwrote the most recent iteration of the file. – Drist Jan 9 '17 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.