since it's possible to recover a deleted file I wonder how one can safely remove a PGP key file (with linux's command line tools) so that it's impossible to recover it. Maybe some dd command? Searched but couldn't find anything.

2 Answers 2



@ryran's comment below is correct. You should use the shred tool (included with all Linux distros) rather than the method described below. The shred tool operates in a similar way, but is designed specifically for the purpose of secure file deletion.

As Graham Hill commented, the only 100% secure measure is physical destruction of the medium, but you can go as far as gaining an overwhelming level of irrecoverability with standard tools you will find on any Linux distribution.


ls -l

in the directory the key is located to find its size in bytes. You can then use:

dd if=/dev/urandom of=./<keyfile name> bs=<size of key file in bytes> count=1

to write random data over they key.

This command will write data from /dev/urandom (an unblocking stream of psuedo-random bytes) over the key file. Do this multiple times for extra security, I think 7 is often recommended but even once will make recovery impractical for most attackers.

  • "to write random data over they key" thank you, that dd command is exactly what I was searching. So instead of overwriting an entire medium with zeros, ones or rand, one overwrites a single file with that. Great. Yes I've read that one or two times of overwriting is enough. Can anyone confirm that this dd command works or at least should be ok?
    – Sunrise
    Commented Dec 12, 2012 at 10:37
  • I can't provide any firm evidence, but the first two results from querying Google with "dd securely erase file" mention this method. Commented Dec 12, 2012 at 10:50
  • I should have searched better! :D I'll read that up there and I guess it's working. Solved.
    – Sunrise
    Commented Dec 12, 2012 at 11:14
  • Don't use dd -- especially not with the block size set to the file size (with huge files this could be disastrous). Next time use shred. It's part of the standard coreutils and should be in any linux distro. It even has an option to tweak how many iterations to do (default: 3). Additionally it does a good job of making even the file name irrecoverable.
    – rsaw
    Commented Dec 12, 2012 at 15:36

For "impossible to recover" you need to physically destroy the disk, I´m afraid.

Of course, depending on your threat model, you may very well be comfortable with something less drastic. In which case, you probably have at least one of shred, srm, or wipe bundled with your Linux distro.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .