Use SHRED over RM to Delete Sensitive Data in Linux

Are you looking for a way to securely delete the sensitive data (or files) from the hard drive in Linux? If yes, then this post is for you. I want to show you the shred command in Linux that overwrite the specified file(s) to hide and delete its contents. We are very much use to of using rm command in Linux to delete the files but in the background it just breaks the link (or unlink) the data block from its index number and the content of the file remains on the hard drive which can possibly be recovered using data recovery software or hardware appliances that makes rm command insufficient when it comes to destroy the data files. shred provides a mechanism to repeatedly overwrite the data file(s) and optionally delete it in order to make it harder for even very expensive hardware probing to recover the data.

Important things to know about shred,
  • shred only works on file(s), not on directories.
  • shred overwrite the file content 3 times with random pattern by default but using -n or --iterations option with shred command the number of overwrites can be increased or decreased.
  • shred does not delete file(s) by default but using -u or --remove option the specified file(s) can be deleted.

Let's see it in action,

[root@sldc-lab-lv6-a ~]# dd if=/dev/zero of=./secret.doc bs=1024 count=1024
1024+0 records in
1024+0 records out
1048576 bytes (1.0 MB) copied, 0.00276469 s, 379 MB/s
[root@sldc-lab-lv6-a ~]# ls -l secret.doc
-rw-r--r--. 1 root root 1048576 Feb  2 02:22 secret.doc
[root@sldc-lab-lv6-a ~]#

We have created a file secret.doc using dd command  and just imagine this is our sensitive data file that we want to destroy completely.

[root@sldc-lab-lv6-a ~]# shred -zuv secret.doc
shred: secret.doc: pass 1/4 (random)...
shred: secret.doc: pass 2/4 (random)...
shred: secret.doc: pass 3/4 (random)...
shred: secret.doc: pass 4/4 (000000)...
shred: secret.doc: removing
shred: secret.doc: renamed to 0000000000
shred: 0000000000: renamed to 000000000
shred: 000000000: renamed to 00000000
shred: 00000000: renamed to 0000000
shred: 0000000: renamed to 000000
shred: 000000: renamed to 00000
shred: 00000: renamed to 0000
shred: 0000: renamed to 000
shred: 000: renamed to 00
shred: 00: renamed to 0
shred: secret.doc: removed
[root@sldc-lab-lv6-a ~]#

In the above command we used three options,
    -z, add a final overwrite with zeros to hide shredding
    -u, truncate and remove file after overwriting
    -v, show progress

But, if you want to use shred command in shell script then you can skip -v and add -f that change permissions of the file to allow writing if necessary.

# shred -fzu secret.doc

CAUTION from the shred manual page,

Note that shred relies on a very important assumption: that the file system overwrites data in place. This is the traditional way to do things, but many modern file system designs do not satisfy this assumption. The following are examples of file systems on which shred is not effective, or is not guaranteed to be effective in all file system modes:
  • log-structured or journaled file systems, such as those supplied with AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)
  • file systems that write redundant data and carry on even if some writes fail, such as RAID-based file systems
  • file systems that make snapshots, such as Network Appliance’s NFS server
  • file systems that cache in temporary locations, such as NFS version 3 clients
  • compressed file systems
In the case of ext3 file systems, the above disclaimer applies (and shred is thus of limited effectiveness) only in data=journal mode, which journals file data in addition to just metadata. In both the data=ordered (default) and data=writeback modes, shred works as usual. Ext3 journaling modes can be changed by adding the data=something option to the mount options for a particular file system in the /etc/fstab file.

In addition, file system backups and remote mirrors may contain copies of the file that cannot be removed, and that will allow a shredded file to be recovered later.

Any feedback will be highly appreciated.

Suggested Posts,

This post appeared on the by Sumit Goel. Copyright © 2012–2014 – and Sumit Goel. All rights reserved. Not to be reproduced for commercial purposes without written permission.

1 comment:

Be sure to check back again because I do make every effort to reply to your comments here.