5

How can I securely delete/shred a file after I accidentally deleted the file insecurely?

Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear leveling uncertainty and sfill).

I stored some super-sensitive data to secret.txt. For some reason, I decided I wanted to delete this file, but I accidentally executed rm secret.txt.

Using testdisk, I can see the newly unlinked file. I can restore the deleted file's contents using testdisk, but--afaik--that would just create a new copy of the file (so doing a restore -> shred may not securely wipe the original file's contents from the disk, and it may actually make the issue worse)

How can I actually shred/srm the blocks containing the original file contents of secret.txt following the accidental execution of rm secret.txt?

  • 1
    Since your question mentions an HDD, you can always fill the HDD with a random garbage file, then delete that. – MechMK1 Jul 27 '19 at 13:59
  • 1
    Note that this HDD fill method is comparable to what shred does. Actually it's better because it's not dependent upon in-place overwites like shred is, but it's time consuming. – user10216038 Jul 27 '19 at 17:33
  • 2
    How about relinking it and then shredding? serverfault.com/questions/168909/relinking-a-deleted-file – RedS Sep 18 '19 at 21:01
  • 1
    @RedS This is a good idea; the question linked refers to the case where the deleted file is still open, so I don't think it's particularly helpful as no /proc/<pid>/ dir would exist for the purposes of my question. Your comment begs the question: how can I extract the inode of a deleted file detected by testdisk, and how can debugfs help if the FS is ext3/4? – Michael Altfield Sep 29 '19 at 6:55
  • 1
    Perhaps you need to look at the code for testdisk to find out how it works and whether the relevant code can be linked so a new console tool can be made to help. Ideally testdisk would be updated to display the inode. – Todd Sep 18 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.