I know that most files, when deleted, aren't actually removed from the disk, and can be recovered later.How can I ensure that a directory I had deleted will actually be removed from the disk? Are there utilities for that?I'm using Debian Linux.
How can I be sure that a directory or file is actually deleted?
files;filesystems;security;data destruction
Encrypt the data before storing it. To erase the data, wipe the key.If you've already written the data in plaintext, it's too late to wipe it in a simple way. There may be multiple copies of the data laying around in various places:on the filesystem if the file was written multiple times (either overwritten or replaced);on the filesystem if it was rearranged as part of defragmentation;in the journal (this is likely to disappear pretty fast after the data was last written);in backups;in disabled sectors (especially on SSD).To get rid of copies of the data on the filesystem, a crude method is to fill the free space (cat /dev/zero >somefile and wait for it to stop because the filesystem is full). This will overwrite all full blocks.Small parts of the data may remain in incomplete blocks that are partially used by other files. This is especially a concern for file names, which may remain in blocks that store directory contents. To get rid of everything, back up all the files, overwrite the device containing the filesystem completely, then restore the files.Storage media may retain data in blocks that are no longer in use. On hard disks, this means bad blocks that have been reallocated; this is a pretty rare occurrence until the disk starts wearing down. On SSD, this is a common occurrence due to wear levelling. In both cases, the threat is very low, because accessing that data requires a somewhat sophisticated attacker with some moderately expensive hardware and time to waste. If you care about these threats, encrypt your data and don't leave your key lying around.Note that you may see advice about erasing data by doing multiple passes or using random data instead of zeroes (Gutmann wipe). Forget it: this applies only to 1980s hard disks (and even then the data is not that cheap to reconstruct and the reconstruction is rather unreliable). Overwriting with zeroes is good enough; doing multiple random passes is obsolete advice or snake oil. See Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?