Erase/Shred File Completely

[engla]

There is also THC's SecureDelete release with several tools like srm. Not much information on the site though, but there are claims it's better than wipe in the README

[art]

the thing with shred is that it may not delete the backups the file had, so it is perfect when wiping partition, but for a single file maybe wipe, or there is even a secure-delete
http://www.thc.org/download.php?t=r&...ete-3.1.tar.gz
will do the job better. I am not sure if these delete the backups too.

[elamericano]

Wipe doesn't work for individual files when "you're wiping a file in a log structured file system" - in other words Ext3. As far as I know Secure Delete shares this limitation as well. It may be that journaling filesystems haven't taken this functionality into account, which would explain why there appear to be no programs that can do it.

I'd using Ext2 and shred, or stick to wiping entire partitions.

-EA

[engla]

Originally Posted by elamericano Wipe doesn't work for individual files when "you're wiping a file in a log structured file system" - in other words Ext3. As far as I know Secure Delete shares this limitation as well. It may be that journaling filesystems haven't taken this functionality into account, which would explain why there appear to be no programs that can do it. I'd using Ext2 and shred, or stick to wiping entire partitions. -EA

I found a claim that you could unmount an ext3 partition and remount it as ext2 when you want to shred files. That should be possible but I don't know if the journal would be damaged.

Otherwise, there must be some kind of kernel hook for this to get around the journaling.

[art]

After some reading it appears to me that there is NO way to completely wipe a file in a journalled file system, so shred or wipe or secure-delete are all the same to some extent... One can always wipe a partition though...

[engla]

Originally Posted by art After some reading it appears to me that there is NO way to completely wipe a file in a journalled file system, so shred or wipe or secure-delete are all the same to some extent... One can always wipe a partition though...

There must be a way for the kernel to do it. For example, you can put swapfiles (not partitions) on a journalled filesystem. The kernel then makes sure that the journal ignores the swapfile (for performance reasons). In the same way, the kernel could "exempt" a file from journaling during the time of the shredding.

[mandragor]

According to this link it should still work:
http://www.slac.stanford.edu/comp/un...ure-erase.html

The reasoning is that ext3 only contains metadata about the file,
so no real content will be revealed by the journaling filesystem.
Also, check out the "scrub"-program that enables secure wiping of
free space.