When a file is deleted, its contents may still be left in the filesystem, unless explicitly overwritten with something else. The wipe command can securely erase files, but does not seem to allow erasing free disk space not used by any files.
"Warning: Modern disk/SSD hardware and modern filesystems may squirrel away data in places where you cannot delete them, so this process may still leave data on the disk. The only safe ways of wiping data are the ATA Secure Erase command (if implemented correctly), or physical destruction. Also see How can I reliably erase all information on a hard drive? You can use a suite of tools called secure-delete. sudo apt-get install secure-delete
This has four tools: srm - securely delete an existing file smem - securely delete traces of a file from ram sfill - wipe all the space marked as empty on your hard drive sswap - wipe all the data from you swap space. From the man page of srm
srm is designed to delete data on mediums in a secure manner which can not be recovered by thiefs, law enforcement or other threats. The wipe algorithm is based on the paper ""Secure Deletion of Data from Magnetic and Solid-State Memory"" presented at the 6th Usenix Security Symposium by Peter Gutmann, one of the leading civilian cryptographers. The secure data deletion process of srm goes like this:
1 pass with 0xff 5 random passes. /dev/urandom is used for a secure RNG if available. 27 passes with special values defined by Peter Gutmann. 5 random passes. /dev/urandom is used for a secure RNG if available. Rename the file to a random value Truncate the file
As an additional measure of security, the file is opened in O_SYNC mode and after each pass an fsync() call is done. srm writes 32k blocks for the purpose of speed, filling buffers of disk caches to force them to flush and overwriting old data which belonged to the file."
I was shocked by how many files photorec could retrieve from my disk, even after wiping.
Whether there is more security in filling the ""free space"" only 1 time with 0x00 or 38 times with different cabalistic standards is more of an academic discussion. The author of the seminal 1996 paper on shredding wrote himself an epilogue saying that this is obsolete and unecessary for modern hardware. There is no documented case of data being physically replaced zeroes and recovered afterwards.
The true fragile link in this procedure is the filesystem. Some filesystems reserve space for special use, and it is not made available as ""free space"". But your data may be there. That includes photos, personal plain-text emails, whatever. I have just googled reserved+space+ext4 and learned that 5% of my home partition was reserved. I guess this is where photorec found so much of my stuff. Conclusion: the shredding method is not the most important, even the multi-pass method still leaves data in place.
You can try # tune2fs -m 0 /dev/sdn0 before mounting it. (If this will be the root partition after rebooting, make sure run -m 5 or -m 1 after unmounting it).
But still, one way or another, there may be some space left.
The only truly safe way is to wipe the whole partition, create a filesystem again, and then restore your files from a backup.
Fast way (recommended)
Run from a directory on the filesystem you want to wipe:
Notes: the purpose of the small file is to reduce the time when free space is completely zero; the purpose of sync is to make sure the data is actually written.
This should be good enough for most people.
Slow way (paranoid)
There is no documented case of data being recovered after the above cleaning. It would be expensive and resource demanding, if possible at all.
Yet, if you have a reason to think that secret agencies would spend a lot of resources to recover your files, this should be enough:
Warning. If you have chosen the paranoid way, after this you would still want to do the fast wipe, and that's not paranoia. The presence of purely random data is easy and cheap to detect, and raises the suspicion that it is actually encrypted data. You may die under torture for not revealing the decryption key.
Very slow way (crazy paranoid)
Even the author of the seminal 1996 paper on shredding wrote an epilogue saying that this is obsolete and unecessary for modern hardware.
But if yet you have a lot of free time and you don't mind wasting your disk with a lot of overwritting, there it goes:
Note: this is essentially equivalent to using the secure-delete tool.
Before the edit, this post was a rewrite of David Spillett's. The ""cat"" command produces an error message, but I can't write comments on other people's posts."
"You can wipe your free space by using secure deletion package.
In that package you can find sfill tool, which is designed to delete data which lies on available diskspace on mediums in a secure manner which can not be recovered by thiefs, law enforcement or other threats.
To install secure deletion package in Linux (Ubuntu), install it by the following command:
$ sudo apt-get install secure-delete
Then to erase your data no free space, try the following command:
sfill -f -v -ll /YOUR_MOUNTPOINT/OR_DIRECTORY
Where /YOUR_MOUNTPOINT/OR_DIRECTORY is your mount point (df -h, mount) or directory to wipe the free space.
Read the manual at http://manpages.ubuntu.com/manpages/hardy/man1/sfill.1.html"
"I use dd to allocate one or more big files to fill up the free space, then use a secure deletion utility.
To allocate files with dd try:
dd if=/dev/zero of=delete_me bs=1024 count=102400
This will generate a file named delete_me that is 100 MB in size. (Here bs is the ""block size"" set to 1k, and count is the number of blocks to allocate.)
Then use your favorite secure deletion utility (I've been using shred) on the files so created.
But NOTE THIS: buffering means even if you do the whole disk, you may not get absolutely everything!
This link recommends scrub for free space wiping. Haven't tried it."
