Securely Delete Files with Wipe

Posted on March 5th, 2008 in Security by admin

Recovery of supposedly erased data from magnetic media is easier than what many people would like to believe. A technique called Magnetic Force Microscopy (MFM) allows any moderately funded opponent to recover the last two or three layers of data written to disk; wipe repeadetly overwrites special patterns to the files to be destroyed, using the fsync() call and/or the O_SYNC bit to force disk access. In normal mode, 34 patterns are used (of which 8 are random). A quick mode allows you to use only 4 passes with random patterns, which is of course much less secure.


Install

For Suse: zypper in wipeFor Ubuntu/Debina: sudo apt-get install wipe

For Fedora:  yum install wipe

Usage

  1. wipe -rkq /home/username/name-of-file
  2. then confirm that you wish to wipe the file, folder, or device.

Explaination of Options

-r (recurse into subdirectories) Will allow the removal of the entire directory tree. Symbolic links are not followed.
-q (quick wipe) If this option is used, wipe will only make (by default) 4 passes on each file, writing random data. See option -Q
-Q <number-of-passes> Sets the number of passes for quick wiping. Default is 4.
-k Keep files: do not unlink the files after they have been overwritten. Useful if you want to wipe a device, while keeping the device special file. This implies -F.
-F Don’t try to wipe file names. Normally, wipe tries to cover file names by renaming them; this does NOT guarantee that the physical location holding the old file name gets overwritten. Furthermore, after renaming a file, the only way to make sure that the name change is physically carried out is to call sync (), which flushes out ALL the disk caches of the system, whereas for ading and writing one can use the O_SYNC bit to get synchronous I/O for one file. As sync () is very slow, calling sync () after every rename () makes filename wiping extremely slow.
For the rest of the switches simply ‘man wipe’ or see the man page here.
 
For journaled file systems see:Securely Delete files from Journaling Filesystems in Linux

Post a comment