According to man rm:

Overwrite regular files before deleting them. Files are overwritten three times, first with the byte pattern 0xff, then 0x00, and then 0xff again, before they are deleted.

How does this compare to the following (used to secure erase whole disk) from a data forensic perspective?

sudo dd bs=1M if=/dev/urandom of=/dev/sda1
sudo dd bs=1M if=/dev/urandom of=/dev/sda1
sudo dd bs=1M if=/dev/urandom of=/dev/sda1
sudo dd bs=1M if=/dev/zero of=/dev/sda1

As a side note, it is my understanding that secure erasing files doesn't work on flash drives or SSDs. Is this understanding correct or is there a secure workaround?

  • I'm aware of a -P option for rm, perhaps you are thinking of rmdir? In any case, many variants of this question exist. Here is a link to one of my answers. The question was about the Cipher commnd, but the answer addresses your questions. security.stackexchange.com/questions/206257/… – user10216038 Apr 2 at 17:32
  • @user10216038 As far as I know, the -P option is not available in the GNU coreutils' version of rm, but is available in BSD's implementation of rm – nobody Apr 2 at 18:59
  • @nobody - I don't keep up with BSD, thanks! Given the same hardware, overwriting 3 times, vice 1, is still pointless. – user10216038 Apr 2 at 19:28
  • @user10216038 Yes, its a waste of time on modern hardware. Not sure why BSD still kept it that way. – nobody Apr 2 at 19:34
  • @user10216038 I believe multiple passes is required when using flash drives or SSDs because of wear levelling. – sunknudsen Apr 2 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.