Quick Guide to Securely Erasing Files in Linux

Did you know that deleted files can be recovered rather easily, at least shortly after deletion? This is because deleting files does not actually erase the data, but simply tells the drive that the previously used space is now free. Until new data gets written to those blocks, the old files are still there and can be recovered with certain software.

If you have sensitive files that you are deleting, or even entire drives that you need to wipe, then it is a good idea to use a secure deletion method in order to ensure that the files can’t be recovered later on. This is especially important if you are selling or lending a hard drive, solid state drive, USB drive, or any other storage device – which once contained sensitive data – to another person.

In this tutorial, you will see how to securely delete files from a Linux system. There are several different utilities that we can employ for the job, so we will look at a few options. You will also learn how to delete entire partitions in a secure manner to ensure that files can’t be recovered by someone later on. Let’s get started!

In this tutorial you will learn:

  • How to securely erase files with shred, wipe, and srm tools
Quick Guide to Securely Erasing Files in Linux
Quick Guide to Securely Erasing Files in Linux
Software Requirements and Linux Command Line Conventions
Category Requirements, Conventions or Software Version Used
System Any Linux distro
Software shred, wipe, srm
Other Privileged access to your Linux system as root or via the sudo command.
Conventions # – requires given linux commands to be executed with root privileges either directly as a root user or by use of sudo command
$ – requires given linux commands to be executed as a regular non-privileged user

How to Securely Erase Files in Linux




Since there are numerous Linux commands that we can use to securely erase files, we will go over a few different options below. Most work similarly to each other, so the one you choose can simply depend on personal preference or whichever tool happens to be installed by default on your system.

DID YOU KNOW?
When we delete a file from a filesystem, the data is not physically removed: the operating system simply marks the area previously occupied by the file, as free and makes it available to store new information. The only way to make sure data is actually removed from a device is to override it with other data.

shred Command

The shred command is often installed by default on various Linux distributions, such as Ubuntu Linux.

shred will, by default, overwrite a file with random data in order to hide its contents.

$ shred example.txt
Using the shred command to hide a file's contents in Linux
Using the shred command to hide a file’s contents in Linux

As you can see in the screenshot above, our once readable plain text file has now been replaced with a bunch of nonsense data. Let’s see another command syntax which will actually remove the file. The following command will overwrite the file with random data multiple times, and then change the file’s name several times, before finally deleting it:

$ shred -uv example.txt

The -u command tells shred to remove the file from our system. The -v option just means verbose and gives us output about what exactly the command is doing.

Removing a file with shred in Linux
Removing a file with shred in Linux




The idea here is that by overwriting the data three times, and renaming the file several times, the block of data which once held our plain text data will now be overwritten with new data. In the event of a storage recovery, the user will only see nonsense random data, if any at all, as opposed to the original data which we have effectively shredded.

In case you are extra paranoid, you can specify the -n option and tell shred how many passes it should perform for overwriting the file with random data. For example, to overwrite with random data 10 times:

$ shred -uvn 10 example.txt 
shred: example.txt: pass 1/10 (random)...
shred: example.txt: pass 2/10 (b6db6d)...
shred: example.txt: pass 3/10 (ffffff)...
shred: example.txt: pass 4/10 (924924)...
shred: example.txt: pass 5/10 (249249)...
shred: example.txt: pass 6/10 (random)...
shred: example.txt: pass 7/10 (aaaaaa)...
shred: example.txt: pass 8/10 (555555)...
shred: example.txt: pass 9/10 (000000)...
shred: example.txt: pass 10/10 (random)...
shred: example.txt: removing
shred: example.txt: renamed to 00000000000
shred: 00000000000: renamed to 0000000000
shred: 0000000000: renamed to 000000000
shred: 000000000: renamed to 00000000
shred: 00000000: renamed to 0000000
shred: 0000000: renamed to 000000
shred: 000000: renamed to 00000
shred: 00000: renamed to 0000
shred: 0000: renamed to 000
shred: 000: renamed to 00
shred: 00: renamed to 0
shred: example.txt: removed

wipe Command

The wipe command is another option we have for securely erasing data. It is not installed by default on most Linux distros, but can be easily installed via package manager.

The basic syntax for the wipe command, along with some of its most popular options, is the following:

$ wipe -rfi /home/linuxconfig/myfiles

The -r option means recursive, so the directory and all of its contents will be erased. The -f options means that the user will not be prompted for confirmation, and the deletion will be forced. The -i option simply gives us output about what the command is doing, making it easier to follow along.

Using the wipe command to securely delete a directory in Linux
Using the wipe command to securely delete a directory in Linux

With the previous command, each file found inside of the directory will be overwritten a whopping 34 times. Then, the file is renamed (moved) numerous times. Each time it is moved, its data will be halved, in order to obscure the original contents even further. Suffice it to say that this process makes it impossible (except on non-standard systems in niche situations) for even the most expensive storage recovery techniques to succeed.

srm Command

Yet another option we have is the srm command from the secure-delete package. This software is sometimes installed by default, but may not be on every system, depending on the distribution. The algorithm used to perform the deletion is based on a paper titled “Secure Deletion of Data from Magnetic and Solid-State Memory.” This research was presented by Peter Gutmann, a renowned cryptographer.

Executing the srm command invokes a process that involves the following steps:

1) Overwriting the data with 0xFF pattern
2) Overwriting file contents 5 times with random data
3) Overwriting the file 27 more times with data suggested by Gutmann
4) Overwriting the file contents 5 more times with random data
5) Renaming the file
6) Truncating the file

This lengthy process ensures that the original data will be completely irrecoverable by thieves, law enforcement, and other potential threats. Now, let’s see how to use the srm command. Most of the options only lessen the security, so we will use the following command:



$ srm -rv /home/linuxconfig/myfiles

The -r option means recursive and will delete all files in the directory. The -v options is for verbose, so we can see the steps that srm is taking to securely delete our specified files:

Using the srm command to securely erase a directory on Linux
Using the srm command to securely erase a directory on Linux

Encryption

It is worth remembering that full disk encryption can fill in the gaps left by secure file deletion. For example, encrypting a Linux partition with LUKS will ensure that all data is not recoverable by another party, regardless of whether the files have been deleted or not.

For the extra paranoid or those dealing with extremely sensitive files, encryption is an essential link in your file security chain. Securely deleting files is still a good idea, because it is simple enough anyway, but encryption will keep prying eyes off of your data even if it is not deleted, or if the physical media falls into the wrong hands.

Using both of these methods – secure deletion and file encryption – are the most extreme measures we can take to secure our data. And both are not very difficult to implement, so these options are available to all users of any experience level. You just need a willingness to learn.

Closing Thoughts

In this tutorial, we saw how to securely erase files on a Linux system. We covered the shred, wipe, and srm commands to delete files and directories and make sure that they would not be recoverable afterwards. These three commands all operate slightly differently, so feel free to use whichever one you believe does the best job, or whichever tool happens to be installed by default on your system. In addition, consider full disk encryption as an additional security measure in case you do not already have it set up.



Comments and Discussions
Linux Forum