2

Which Linux shell command can completely remove a file from the system and make it unrecoverable ?

I have tied rm and shred but they have their limitations:-

rm --help

and see the information, you will see a note there like this

Note that if you use rm to remove a file, it might be possible to recover some of its contents, given sufficient expertise and/or time. For greater assurance that the contents are truly unrecoverable, consider using shred.

this note suggests to use the shred command so do I did

shred --help

Overwrite the specified FILE(s) repeatedly, in order to make it harder for even very expensive hardware probing to recover the data.

This seems like a good note and I was relaxed that my file will be removed completely now or at least will be harder to recover. and made my mind to use shred instead of rm from now but wait got this CAUTION in the end.

CAUTION: Note that shred relies on a very important assumption: that the file system overwrites data in place. This is the traditional way to do things, but many modern file system designs do not satisfy this assumption. The following are examples of file systems on which shred is not effective, or is not guaranteed to be effective in all file system modes:

  • log-structured or journaled file systems, such as those supplied with AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)
  • file systems that write redundant data and carry on even if some writes fail, such as RAID-based file systems
  • file systems that make snapshots, such as Network Appliance's NFS server
  • file systems that cache in temporary locations, such as NFS version 3 clients
  • compressed file systems

In the case of ext3 file systems, the above disclaimer applies (and shred is thus of limited effectiveness) only in data=journal mode, which journals file data in addition to just metadata. In both the data=ordered (default) and data=writeback modes, shred works as usual. Ext3 journaling modes can be changed by adding the data=something option to the mount options for a particular file system in the /etc/fstab file, as documented in the mount man page (man mount).

In addition, file system backups and remote mirrors may contain copies of the file that cannot be removed, and that will allow a shredded file to be recovered later.

at last I read a few blogs but could not find a command which does the job, can anyone suggest a better command than these two or a way to remove the file as I have some important credentials file which I need to remove completely?

slhck
  • 235,242
Adarsh Goyal
  • 21

1 Answers1

0

I would suggest either:

The Secure-delete suite of tools

Or BleachBit

These articles provide a good overview of each one and their use:

https://www.unixmen.com/securely-delete-hard-drive-data-with-secure-delete/

https://ssd.eff.org/en/module/how-delete-your-data-securely-linux

I also strongly recommend reading this section of the BleachBit Docs for an excellent write-up on properly securing/deleting data in general... in short, for your use-case:

  1. Shred the file/s ('srm' in secure-delete).
  2. Overwrite all free disk space ('sfill' in secure-delete).
  3. Ideally encrypt the data (e.g. credentials could be stored in a passwors keeper, like KeePassXC) and/or the entire drive/volume in future.
  4. And in the end, mechanically destroy or degauss the drive (if it's that important to you).

Hope that helps.

user1138
  • 298
  • 1
  • 3
  • 8