Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I know how to secure delete files. But at our company, we have a laptop which had many important documents, which now have been deleted, but not in a secure way.

We can't perform a full format of the disk since it would be a complex task to restore everything again. I would like to ask if there's a way to do a "secure clean" of the remaining free space, so those documents couldn't be recovered anymore.

System that is being used is Mac OS X.

share|improve this question
add comment

3 Answers

You could create big files until the disk is full. Something like this:

dd if=/dev/zero bs=8192 of=junkfile
# ... wait for the disk to fill up, at which point this command exits
sync
rm junkfile

The sync command makes sure that all the zeros in the new file make it to the disk. Then, the rm gives you back your disk space. You should run these commands as root (use sudo) because the OS reserves some space which only root can fill.

Such a method does not completely guarantee that the deleted files have been utterly destroyed, but at least they will not be recoverable at the logical level (it will thwart attackers as well as a "full format", so that's not bad).

Of course, since laptops can be stolen or simply dropped on the floor at inopportune times, I sincerely hope that you do have backups and could "restore everything" in such a situation.

share|improve this answer
    
see also 'shred' in the Gnu coreutils pkg - gnu.org/software/coreutils –  symcbean Oct 24 '11 at 9:58
add comment

See How can files be deleted in a HIPAA-compliant way?

For OS X, the system includes a way to wipe all free space in the Disk Utility program, but that does not take care of slack space (the space between the end of a file and the end of its block). BCWipe can take care of slack space.

HFS+ reserves chains of filesystem space before writes in order to speed up writing. Space may be reserved and then later freed, resulting in free space containing data after a wipe.

Cache files, preloads and memory paged to disk may also result in unexpected disclosures. If you really feel it's still worth approaching, How to wipe file slack on OS X has some tips.

share|improve this answer
add comment

I know you say it would be complex to restore the laptop, but the most reliable and secure method is to back up the files you want to keep, securely erase the entire hard drive (using ATA Secure Erase or DBAN), re-install the OS, and restore from backup the files you want to keep.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.