Delete files securely on a journaling filesystem.

Asked by Montel Edwards

I have some very confidental files on my computer that I store such as credit reports, and other things. I always encrypt them with GPG, but there still is that original non-encrypted file left that needs to be deleted. I looked into tools like wipe, and shred but they all say that it really doesn't help on journaling filesystems directly on their man page.

I am not asking how to wipe the whole drive with dd or anything, but I am simply asking if there is a tool that'll delete a single file securely.

Thanks
- Montel

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Solved by:
Sam_
Solved:
Last query:
Last reply:
Revision history for this message
George Standish (george-standish-deactivatedaccount) said :
#1

Do you happen to be using Ext3 or Ext4 as the file system? If so, you should see the FAQ at http://ext4.wiki.kernel.org/index.php/Frequently_Asked_Questions and read "4.4 Can I undelete files in Ext4?" which says "No, in the same way that the ext3 journal requirements to be consistent after a crash prevent undelete of ext3 files, it isn't possible to undelete ext4 files."

If you follow the "Undelete in ext3 files" link, will bring you to http://ext4.wiki.kernel.org/index.php/Undeletion which does list software that attempt to undelete files "with varying success". So, perhaps it is still theoretically possible to undelete the files.

I realize this isn't quite the "wipe" answer you where looking for, but it's certainly something to keep in mind.

Best of luck,
George

Revision history for this message
Sam_ (and-sam) said :
#2
Revision history for this message
Montel Edwards (montel) said :
#3

Also,
I have my home directroy encrypted with ecryptfs..
Does that mean that even if it was not encrypted (with like gpg) and
they took my hdd they would see a whole bunch of garbage?

Now how do I encrypt the whole partition?

On 2/20/10, Sam <email address hidden> wrote:
> Your question #101681 on Ubuntu changed:
> https://answers.launchpad.net/ubuntu/+question/101681
>
> Sam proposed the following answer:
> Best practice would be to encrypt disk (partition) or content of file before
> saving (like in gedit).
> http://wiki.services.openoffice.org/wiki/Security/Encryption
> http://sun.systemnews.com/articles/137/1/OpenOffice/21921
> http://selliott.org/encryption/openoffice
>
> http://www.sun.com/software/staroffice/faqs.jsp#t2
>
> btw.
> http://www.nber.org/sys-admin/overwritten-data-gutmann.html
>
> --
> If this answers your question, please go to the following page to let us
> know that it is solved:
> https://answers.launchpad.net/ubuntu/+question/101681/+confirm?answer_id=1
>
> If you still need help, you can reply to this email or go to the
> following page to enter your feedback:
> https://answers.launchpad.net/ubuntu/+question/101681
>
> You received this question notification because you are a direct
> subscriber of the question.
>

Revision history for this message
Best Sam_ (and-sam) said :
#4
Revision history for this message
Sam_ (and-sam) said :
#5
Revision history for this message
Montel Edwards (montel) said :
#6

I just zero-filled my HDD (2 pass) and I set up the encryption with
the alternate install.

I also encrypted my home directory, and encrypted the files that are
confidential with GPG (4096 bit key) :P

So I think that I got my system pretty secure!
Oh, I have a BIOS password too :)

Now do you think that the encryption with the patition from the
alternate install is slowing write/delete speeds? I'm sure that it's
probably a placebo effect but it seems like it is to me.

But thanks for all your help.

On 2/20/10, Sam <email address hidden> wrote:
> Your question #101681 on Ubuntu changed:
> https://answers.launchpad.net/ubuntu/+question/101681
>
> Sam posted a new comment:
> http://brainstorm.ubuntu.com/idea/6168/
>
> --
> You received this question notification because you are a direct
> subscriber of the question.
>

Revision history for this message
Montel Edwards (montel) said :
#7

Thanks Sam, that solved my question.

Revision history for this message
Sam_ (and-sam) said :
#8
Revision history for this message
rob brewer (kowloonbl) said :
#9

Hey there, I just say these posts after looking around, sadly, it is far too easy to recover files on ext3 or 4 files systems even after they have been overwritten even 10's of times. I am paranoid of leaving traces of anything on my computer, (25 years of USAF SIGINT/COMINT Intel experience) so I have been looking for ways to wipe files. I have used rm, srm (38 passes) and also bleachbit files removal and free space wiper. I made some files and deleted them with all of these programs and retrieved them all back again within less than 5 minutes using Photorec from the testdisk package. I even found Windows 7 files I thought had been overwritten after my Ubuntu install. Perhaps what I was actually recovering were the files written multiple times to different areas of the hdd, but I only gave photorec about 3 minutes to read the 1st few gb so doubt that was the case. I don't know why it is so easy to get the files back, but I had NO problems even after multiple overwrites.
Maybe I misunderstood these posts and I apologize for any misconceptions.