1

I see a lot of posts about how to recover deleted files. But I'm asking about how to make sure that deleted files are un-recoverable. On an HDD and/or SSD. Sometimes we end up doing a delete instead of a shred, and need to ensure that nobody can access the file if the device is stolen or lost.

This would basically follow the steps:

  1. Search for recoverable files.
  2. Overwrite them with zeroes or random bits.

Any way to do this?

Reason: It is just not practical to do a full disk/partition wipe or even a free space wipe for every time I want to get rid of a few recoverable files that I deleted instead of remembering to shred it. Even if an encrypted partition is used, the files would be recoverable by anyone who has access to the password, or can guess or brute-force the password.

8
  • For HDDs you would need to overwrite the same sectors of the disk. For an SSD, TRIM will generally take care of this automatically on modern hardware. Is this something you want to do from time to time? Or is this just at a devices end-of-life? 🤔
    – matigo
    Dec 27, 2021 at 8:37
  • superuser.com/questions/19326/… With modern drives and file systems not always 100% reliable. Just wipe the entire disk to be sure your nuclear secrets cannot be retrieved.
    – vanadium
    Dec 27, 2021 at 8:49
  • 1
    If you plan to keep some secret info on your storage device, it is always good idea to use full disk encryption or at least encrypt the files that contain such sensitive information. This way your secrets are always safe while on rest.
    – FedKad
    Dec 27, 2021 at 9:13
  • I see that TRIM is programmed to run weekly by default. The thing is, doing a full-disk or full-partition wipe takes long...and reduces SSD life. I had enabled full-disk encryption once, but it eventually made things noticeably slower. Moreover, full-disk encryption isn't possible for a dual-boot Windows-Linux system. Finding recoverable files is already possible. We know where the file starts and ends. I hope someone implements the simple functionality of overwriting bits of such files that are found.
    – Nav
    Dec 27, 2021 at 10:27
  • 1
    Good point, Nav. You seem comfy with C/C++, so modifying the source of software like TestDisk may be the fastest approach: github.com/cgsecurity/testdisk/blob/master/INSTALL. Hopefully, someone would integrate this feature into TestDisk permanently.
    – John David
    Jan 10, 2022 at 17:26

1 Answer 1

1

All I'm asking for, is a software that can detect a recoverable file and overwrite some of the bits of the file

I don't think this is possible.

The file is still on the disk, but you deleted the information where the file is located. So a software does not know what to delete.

There could be a software to search and locate the file, then wipe only this part. If the file is located in the beginning of the empty space, that could speed up the process a lot. But you need information what the file looks like (have parts of the content or a duplicate to compare, etc.).

Anyways, I don't know of a software like that.

Testdisks photorec can locate files (not a specific though). Instead of recovering, it could also delete the finds if there was an option to do so.


To prevent situations like this, the best option would be to use Full Disk Encryption.

3
  • Even with full disk encryption, the files would be recoverable by anyone who has access or can guess/brute-force the password. If photorec can locate all the bits of (perhaps even a fragmented) file (which is obviously how it manages to recover the file), I'm hoping it'd be possible to get the addresses of those locations on disk (or at least some of the bits) and overwrite them with random bits.
    – Nav
    Jan 21, 2022 at 9:06
  • Yes. Anyone with access can do a lot of things. But if you use good passwords, no one can guess or brute-force it. If you are still not convinced, use keyfiles.
    – pLumo
    Jan 21, 2022 at 9:11
  • Perhaps another way would be to modify Nautilus' and Bash's delete function to invoke shred, so I wont have to remember to shred files. I assume this would require learning how to make changes to Ubuntu source code and apply the patch to my installed Ubuntu.
    – Nav
    Jan 24, 2022 at 1:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .