I know that most files, when deleted, aren't actually removed from the disk, and can be recovered later.
How can I ensure that a directory I had deleted will actually be removed from the disk? Are there utilities for that?
I'm using Debian Linux.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
Encrypt the data before storing it. To erase the data, wipe the key.
If you've already written the data in plaintext, it's too late to wipe it in a simple way. There may be multiple copies of the data laying around in various places:
To get rid of copies of the data on the filesystem, a crude method is to fill the free space (
cat /dev/zero >somefile and wait for it to stop because the filesystem is full). This will overwrite all full blocks.
Small parts of the data may remain in incomplete blocks that are partially used by other files. This is especially a concern for file names, which may remain in blocks that store directory contents. To get rid of everything, back up all the files, overwrite the device containing the filesystem completely, then restore the files.
Storage media may retain data in blocks that are no longer in use. On hard disks, this means bad blocks that have been reallocated; this is a pretty rare occurrence until the disk starts wearing down. On SSD, this is a common occurrence due to wear levelling. In both cases, the threat is very low, because accessing that data requires a somewhat sophisticated attacker with some moderately expensive hardware and time to waste. If you care about these threats, encrypt your data and don't leave your key lying around.
Note that you may see advice about erasing data by doing multiple passes or using random data instead of zeroes (“Gutmann wipe”). Forget it: this applies only to 1980s hard disks (and even then the data is not that cheap to reconstruct and the reconstruction is rather unreliable). Overwriting with zeroes is good enough; doing multiple random passes is obsolete advice or snake oil. See Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?
There is a very popular tool called
shred. It will overwrite every file 25 times before it will be deleted. That might me what you are looking for.
Usage of shred is quite simple
$ shred secret_archive.tar.gz
Note however that on modern systems
shred might be inefficient or useless if:
Other and potentially more secure options are:
bcwipe still has its uses. Not privacy. Who else zero-fills the free space on my ProxMox kvm machines? That is expressed in 20 times reduction in vzdump size for a kvm machine having a lot of free space. It has the same amount of free space as before, only it's only zeros, and these get archived with a high rate of compression.