0

We all know that deleting a file from your computer does not really erase it, but only marks as free the memory where the file was written, so that, until such memory is not overwritten, the file can still be recovered by reading the raw memory.

To really erase a file, its memory must be overwritten by random data or simply zeros, using tools as shred. (I'm going to assume that no physical method to recover data from erased memory is possible.)

This has to be done manually for every file we want to erase; In particular, if we use a software that keeps some sensitive data (for example, the "recent files history"), we have to erase them by ourselves instead of trusting the delete function of the software (that is, clicking, "delete recent files history"); which requires many awareness and/or customizations.

My question is: Is there a way to ensure that computer files are always deleted by being overwritten with zeros? I mean, a filesystem or OS that does so? In such a case, except for the memory allocated for the files that are present in the filesystem, the whole memory would be always filled with zeros.

I straightforward way to do so could be modify how the OS handles the "delete" filesystem command in a way to run an erase tool, but it doesn't seem trivial to do.

Notes:

  • One may suggest to simply encrypt the whole filesystem, and who cares about deleted file or not... they are protected by the password. However, this solution is subjected to rubber-hose cryptanalysis.
Improve this question
4
  • 1
    I dont what exactly are you asking?The shred command already does and you say it does then you say that you don't want to change os delete function.So what exactly are you even asking?
    – yeah_well
    Nov 4, 2019 at 12:24
  • instead of using rm -r filename you could use the shred command.I feel you are simply making up a problem in your mind that doesn't even exist in the first place
    – yeah_well
    Nov 4, 2019 at 12:33
  • This is actually a more complex subject than it may appear. Shredding techniques are good, but depend on many factors (shadow copies for Windows) as well as the medium (HDD versus SSD). If your threat model is that you're concerned about technically sophisticated attacks where they may read the individual data cells in an SSD, you need to address that more then. SSDs use wear leveling, which makes repeated overwrites not as useful since the data cells the overwrites will hit will be random and not always the actual location of your data.
    – Jarrod Christman
    Nov 4, 2019 at 15:19
  • Regardless of how the OS treats file deletion, the 'Recently Opened Files' feature some software offers will be totally unaffected by how comprehensively the file has been deleted. The names and most likely former location of those files will still be stored in the software.
    – JustAnotherDev
    Nov 5, 2019 at 9:50

1 Answer 1

Reset to default
1

"Shred" isn't always as effective as you might think, since it relies on the assumption of in-place overwrites.

Using a Solid State Drive (SSD) with TRIM function enabled will reliably remove deleted data, but sometimes there's a delay that can stretch out to many minutes before TRIM does its thing.

None of the above approaches address alternate storage such as cache, or shadow files.

If you're really serious about protection, use a Bootable Non-Persistent OS where everything is in RAM and no changes survive after a power down.

Improve this answer
1
  • It should be noted that it depends on the threat model and what kind of information disclosure needs to be prevented. As JustAnotherDev mentioned in a comment above, just knowing that one of the recently opened files is called ImportantDocument_ConfidentialCustomer_ConfidentialProject.docx may be enough for an attacker.
    – user163495
    Nov 6, 2019 at 12:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .