Fhyujk

Before I lend my laptop for a while to my young and linux-savy nephew I want to make sure he's not able to carve into my personal data in the blank space of the drive. I have saturated the blank space in the drive several times with

sudo cat /dev/urandom > some-file

Note the use of sudo, so that the 5% blank space reserved is ignored and the file grows until there is an error.

However, I execute photorec in that partition and then hundreds of old files pop out into existence. So, at least out of curiosity, where are those files stored and why does the random noise not overwrite them?

(The only explanation I have so far is, they might be in the empty space between the end of a file and the end of the sector that contains it. Could that be?)

There may be several misunderstandings here, so the command does not do what you perhaps expect it to.

sudo is superfluous since you don't need sudo to read from /dev/urandom. The > goddamnit part is a shell redirection and thus not covered by sudo at all. So your sudo is super ineffective. (Note: in this particular case, sudo might work as intended regardless, see comments. However, not using sudo this way is a pattern as it bites you in other cases.)

Then, you're writing into a regular file. That does fill up free space - of the filesystem that file happens to reside on. If you have multiple filesystems (one for /, one for /home, boot and swap partitions, etc.) then those are also unaffected.

At best this only overwrites free space. There is no guarantee that it will cover everything (depends on filesystem internals, root reserve, journal, otherwise packed/reserved/etc. sectors), and it does not overwrite any file that is still there regularly (and those can include files hidden away in trashcan / thumbnail / cache folders or just some subdirectory you forgot about).

All of those will still be picked up by photorec since it's never overwritten.

Furthermore, writing this file has to be completed first. So instead of deleting it directly afterwards, you'd have to sync first to make sure all that random data actually hit the disk, and not just some RAM write buffer and never gets written.

So with this method, there is no guarantee for anything. At the same time it's dangerous, as the filesystem will run out of free space, which in turn can cause write failures for all other programs and thus result in unintentional data loss.

How to get rid of all data, that your nephew should not see

I think there is only one way that is likely to overwrite all the locations, where 'deleted' data might remain.

• Backup your system (a complete backup). One alternative is to make a cloned image with Clonezilla.




• Wipe the whole drive (assuming one drive). If an HDD or SSD, there are special tools/methods, that work at a low level (change the mapping between logical and physical memory locations), and they are much faster than for example letting dd overwrite with zeros. You can often access such tools (built-in the drives) via hdparm.




• Make a fresh installation and hand over the computer to the young and linux-savvy nephew.

The easy way

But if you can afford it, unplug your internal drive and replace it with a fresh drive. Let your nephew install his favourite linux distro :-)

Try using the sfill (Secure fill) tool in secure delete.

sudo apt-get install secure-delete

(from https://superuser.com/questions/19326/how-to-wipe-free-disk-space-in-linux )