7

Before I lend my laptop for a while to my young and linux-savy nephew I want to make sure he's not able to carve into my personal data in the blank space of the drive. I have saturated the blank space in the drive several times with

sudo cat /dev/urandom > some-file

Note the use of sudo, so that the 5% blank space reserved is ignored and the file grows until there is an error.

However, I execute photorec in that partition and then hundreds of old files pop out into existence. So, at least out of curiosity, where are those files stored and why does the random noise not overwrite them?

(The only explanation I have so far is, they might be in the empty space between the end of a file and the end of the sector that contains it. Could that be?)

Improve this question
6
  • @JeffSchaller thanks, at least I'm not alone, makes me feel better ;-)
    – frostschutz
    Feb 26, 2019 at 19:19
  • Just wanted to focus on the core of the question...
    – Jeff Schaller ♦
    Feb 26, 2019 at 19:21
  • 1
    @JeffSchaller it does not open the file as superuser, but it does write to it as superuser.
    – user313992
    Feb 26, 2019 at 19:39
  • @Mephisto some filesystems store the content of small files and directories directly in the free space from the inode. Or at least so was my impression -- I'll have to check ;-)
    – user313992
    Feb 26, 2019 at 19:43
  • A thing to note is that, photorec might find a lot of old files based on metadata, but is actually unable to fully restore them. Unsuccessfully restored files will just be garbage data or just chunks of files.
    – Robert Riedl
    Feb 27, 2019 at 13:07

3 Answers 3

Reset to default
17

There may be several misunderstandings here, so the command does not do what you perhaps expect it to.

sudo is superfluous since you don't need sudo to read from /dev/urandom. The > some-file part is a shell redirection and thus not covered by sudo at all. So your sudo is super ineffective. (Note: in this particular case, sudo might work as intended regardless, see comments. However, not using sudo this way is a pattern as it bites you in other cases.)

Then, you're writing into a regular file. That does fill up free space - of the filesystem that file happens to reside on. If you have multiple filesystems (one for /, one for /home, boot and swap partitions, etc.) then those are also unaffected.

At best this only overwrites free space. There is no guarantee that it will cover everything (depends on filesystem internals, root reserve, journal, otherwise packed/reserved/etc. sectors), and it does not overwrite any file that is still there regularly (and those can include files hidden away in trashcan / thumbnail / cache folders or just some subdirectory you forgot about).

All of those will still be picked up by photorec since it's never overwritten.

Furthermore, writing this file has to be completed first. So instead of deleting it directly afterwards, you'd have to sync first to make sure all that random data actually hit the disk, and not just some RAM write buffer and never gets written.

So with this method, there is no guarantee for anything. At the same time it's dangerous, as the filesystem will run out of free space, which in turn can cause write failures for all other programs and thus result in unintentional data loss.

Improve this answer
7
  • 4
    The sudo is there to ensure writing to the 5% (or some similar amount) reserved space, otherwise it will stop writing at the same time when the normal user file browsers report 0 bytes. With sudo, it does write an additional 50 GB more or less, don't ask me why.
    – Mephisto
    Feb 26, 2019 at 18:45
  • @Mephisto I admit I haven't tested it ( difficult for me since sudo is not installed here ) so I could be wrong about it, and shell redirection only is a problem when trying to write to a file already owned by root ( no permission to open / append as that's done by the shell before sudo runs ).
    – frostschutz
    Feb 26, 2019 at 18:49
  • 4
    I confirm, we were wrong about the reserved space not filling up: what matters is the EUID of the file doing the writing, not the ownership of the file. It makes sense in retrospect — the way the restriction works is that the kernel returns ENOSPC on the write call, and the exception is based on who called write.
    – Gilles 'SO- stop being evil'
    Feb 26, 2019 at 19:02
  • 1
    Thanks for confirming, I'd still argue it's bad style to use sudo this way, as it gives the wrong idea about how sudo normally works when writing to files. (I'd also argue that writing random data is better than writing zero, you never know if the filesystem or storage device compresses/deduplicates data.)
    – frostschutz
    Feb 26, 2019 at 19:04
  • 1
    @larsks: Opening the file will be done as the original user ID (and so it will get the user's ID as its owner). Writing the file (i.e. write(2)) will be done as root, and as Gilles points out, this does in fact avoid the reserved space restriction.
    – Nate Eldredge
    Feb 27, 2019 at 14:57
9

How to get rid of all data, that your nephew should not see

I think there is only one way that is likely to overwrite all the locations, where 'deleted' data might remain.

  • Backup your system (a complete backup). One alternative is to make a cloned image with Clonezilla.

  • Wipe the whole drive (assuming one drive). If an HDD or SSD, there are special tools/methods, that work at a low level (change the mapping between logical and physical memory locations), and they are much faster than for example letting dd overwrite with zeros. You can often access such tools (built-in the drives) via hdparm.

  • Make a fresh installation and hand over the computer to the young and linux-savvy nephew.

The easy way

But if you can afford it, unplug your internal drive and replace it with a fresh drive. Let your nephew install his favourite linux distro :-)

Improve this answer
4

Try using the sfill (Secure fill) tool in secure delete.

sudo apt-get install secure-delete

(from https://superuser.com/questions/19326/how-to-wipe-free-disk-space-in-linux )

Improve this answer
4
  • 2
    This does not answer the question, which asks “why”.
    – Gilles 'SO- stop being evil'
    Feb 26, 2019 at 18:51
  • But that thing, acording to man sfill will do a lot of passes of zeros, noise and special values. This is overwriting the same area I overwrite with one (actually 4 by now) pass. Those files must be stored somewhere else.
    – Mephisto
    Feb 26, 2019 at 18:52
  • 2
    Well, I would say it's overwriting the area you intend to overwrite but are not quite successfully overwriting.
    – L. Scott Johnson
    Feb 26, 2019 at 18:53
  • @Gilles, since this is a XY Question/Problem, I think its still a good answer.
    – Robert Riedl
    Feb 27, 2019 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .