Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

since it's possible to recover a deleted file I wonder how one can safely remove a PGP key file (with linux's command line tools) so that it's impossible to recover it. Maybe some dd command? Searched but couldn't find anything.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

Update:

@ryran's comment below is correct. You should use the shred tool (included with all Linux distros) rather than the method described below. The shred tool operates in a similar way, but is designed specifically for the purpose of secure file deletion.


As Graham Hill commented, the only 100% secure measure is physical destruction of the medium, but you can go as far as gaining an overwhelming level of irrecoverability with standard tools you will find on any Linux distribution.

Use:

ls -l

in the directory the key is located to find its size in bytes. You can then use:

dd if=/dev/urandom of=./<keyfile name> bs=<size of key file in bytes> count=1

to write random data over they key.

This command will write data from /dev/urandom (an unblocking stream of psuedo-random bytes) over the key file. Do this multiple times for extra security, I think 7 is often recommended but even once will make recovery impractical for most attackers.

share|improve this answer
    
"to write random data over they key" thank you, that dd command is exactly what I was searching. So instead of overwriting an entire medium with zeros, ones or rand, one overwrites a single file with that. Great. Yes I've read that one or two times of overwriting is enough. Can anyone confirm that this dd command works or at least should be ok? –  Sunrise Dec 12 '12 at 10:37
    
I can't provide any firm evidence, but the first two results from querying Google with "dd securely erase file" mention this method. –  mckiethanks Dec 12 '12 at 10:50
    
I should have searched better! :D I'll read that up there and I guess it's working. Solved. –  Sunrise Dec 12 '12 at 11:14
    
Don't use dd -- especially not with the block size set to the file size (with huge files this could be disastrous). Next time use shred. It's part of the standard coreutils and should be in any linux distro. It even has an option to tweak how many iterations to do (default: 3). Additionally it does a good job of making even the file name irrecoverable. –  ryran Dec 12 '12 at 15:36
    
Thanks @ryran, I've updated the answer. –  mckiethanks Dec 12 '12 at 15:47

For "impossible to recover" you need to physically destroy the disk, I´m afraid.

Of course, depending on your threat model, you may very well be comfortable with something less drastic. In which case, you probably have at least one of shred, srm, or wipe bundled with your Linux distro.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.