How long the deleted files linger in your hard drives?

[Terminal Velocity]

How long until they can't be recovered anymore? As I understand must be another file written in the space that was occupied by the deleted file in order not to be able to recover it anymore.

But is there a way to zero out the occupied space of a deleted file without having to zero the whole drive? If not, it should exist

 

[The Duck]

is there a way to zero out the occupied space of a deleted file without having to zero the whole drive? If not, it should exist

If you learn what each of the features in Bleachbit clear out, clean out, and remove then it can be used to write over the free space with 1s and 0s.

Bleachbit is only dangerous when the user fails to learn how to properly use it.

I spent the time to learn how to use Bleachbit and have never had a problem.

The horror stories you read about how Bleachbit will destroy your working Linux distro or any other operating system is because users failed to learn how to properly use bleachbit.

I'm not going to get into any arguments over Bleachbit as I can destroy any Linux distro using certain commands in the terminal.

 

[Terminal Velocity]

So there's a way but is kinda dangerous. Interesting. My approach is to fill my hard drives with movies over time

 

[ron.alan]

I don't think you want to overwrite data on a SSD. However, if you have the old fashioned spinners, you can use this in the terminal (you can use whatever number you want):

shred --remove --iterations=3 /path/to/file/

There's also this (but it's been so long since I've shredded anything, probably years, that I don't remember what the difference is between them):

shred -uvz -n 3 /path/to/file/

 

[Terminal Velocity]

I don't think you want to overwrite data on a SSD. However, if you have the old fashioned spinners, you can use this in the terminal (you can use whatever number you want):

shred --remove --iterations=3 /path/to/file/

There's also this (but it's been so long since I've shredded anything, probably years, that I don't remember what the difference is between them):

shred -uvz -n 3 /path/to/file/

Very interesting Thanks

 

[The Duck]

I don't think you want to overwrite data on a SSD. However, if you have the old fashioned spinners, you can use this in the terminal (you can use whatever number you want):

shred --remove --iterations=3 /path/to/file/

There's also this (but it's been so long since I've shredded anything, probably years, that I don't remember what the difference is between them):

shred -uvz -n 3 /path/to/file/

Good point and never owning an SSD would not know that so learned something new.

 

[Terminal Velocity]

I also found nautilus-wipe which is GUI
https://packages.debian.org/bullseye/nautilus-wipe
But it is not in the software manager in Debian 11

 

[Vimmer]

I've been thinking about this because I have been watching forensic files: does zeroing out the hard drive, then scrambling with random data (there are programs for that), then zeroing out make everything that was there un-recoverable?

 

[Condobloke]

Why in the name of all that's holy would you worry about such minutiae ?!

I have a 250 gb drive which is 12.7% full

I add the occasional .iso file and all sorts of associated garbage...plus the usual in and out of email and net stuff associated with Linux.org etc etc etc

Usually at the end of the day or sometime the next day, I will throw it in the bin....it has served its purpose.

The end result......within minutes.....12.7% full

The occasional (read when I happen to think of it) : sudo fstrim -av .....produces...

brian@brian-desktop:~$ sudo fstrim -av
[sudo] password for brian:
/boot/efi: 504.9 MiB (529436672 bytes) trimmed on /dev/nvme0n1p1
/: 202.9 GiB (217870467072 bytes) trimmed on /dev/nvme0n1p2
brian@brian-desktop:~$

life's tough, eh?

 

[Aristarchus]

How long until they can't be recovered anymore? As I understand must be another file written in the space that was occupied by the deleted file in order not to be able to recover it anymore.

But is there a way to zero out the occupied space of a deleted file without having to zero the whole drive? If not, it should exist

What is your threat model?
Why are you keeping important data on your hard drive?
Why are you not using data encryption?

In other words, there are better ways of protecting important data than wiping them out. Which is always too late.

 

[The Duck]

Why are you keeping important data on your hard drive?

I keep nothing important on any computer and anything I need to save is saved to removable media at the time.

I'm not a trusting soul.

 

[GatorsFan]

I use BleachBit myself - back in 2016 Hillary Clinton used BleackBit to wipe her email servers https://www.politico.com/story/2016/08/hillary-clinton-emails-bleachbit-227425
The FBI did not recover any data

 

[The Duck]

I use BleachBit myself - back in 2016 Hillary Clinton used BleackBit to wipe her email servers https://www.politico.com/story/2016/08/hillary-clinton-emails-bleachbit-227425
The FBI did not recover any data

If it's good enough for Hilary it's good enough for me.

 

[Terminal Velocity]

What is your threat model?
Why are you keeping important data on your hard drive?
Why are you not using data encryption?

In other words, there are better ways of protecting important data than wiping them out. Which is always too late.

When you create an encrypted file, the unencrypted version of it isn't in your hard drive? Won't you delete it? If someone tries to recover deleted files from your hard drive they may find the unencrypted version it if it's not overwritten by then. This is how they try to recover files from ransomware attacks, after the virus encrypts the file then it deletes the original, so there is chance to find that original in a recovery attempt

My threat model is simple, I consider my self target, I don't worry about hackers, I worry about those supposed to protect me

 

[CaffeineAddict]

When you create an encrypted a file, the unencrypted version of it isn't in your hard drive? Won't you delete it? If someone tries to recover deleted files from your hard drive they may find the unencrypted version it if it's not overwritten by then.

File encryption make sense to use only if you transfer encrypted files to another media such as DVD, external HDD or cloud storage.

But for your main drive where OS is installed and where you do actual file encryption and deletion, that drive should be itself encrypted, that is the disk should be encrypted then nobody will be able to recover and read any of the deleted files.

Do you use disk encryption?

 

[The Duck]

My threat model is simple, I consider my self target, I don't worry about hackers, I worry about those supposed to protect me

That was always something that some users I knew always wondered about antivirus suites back in my days of using Windows OSs.

My threat model is simple, I consider my self target, I don't worry about hackers, I worry about those supposed to protect me

If that is really what you're concerned about than I'd remove the HDD/SSD and run in live mode only and save to external media as needed.

 

[Terminal Velocity]

File encryption make sense to use only if you transfer encrypted files to another media such as DVD, external HDD or cloud storage.

But for your main drive where OS is installed and where you do actual file encryption and deletion, that drive should be itself encrypted, that is the disk should be encrypted then nobody will be able to recover and read any of the deleted files.

Do you use disk encryption?

Debian 11 was a disappointment in that regard since it doesn't return from sleep with encrypted installation, something I use a lot, and of course the whole computer is terribly slow, almost unusable. I can't justify putting myself in such trouble so I went with 7z the way i describe in the other thread

 

[MikeWalsh]

I'll say what I always do with these kinds of threads.....which are usually started by those who need to assure themselves that what they're doing is considered 'normal' by other users:-

1. Encryption is more trouble than it's worth. You've only to forget - or lose - your encryption password, and you're f**ked.

2. The only data worth keeping 'safe' is your personal data. Forget the OS itself; it can ALWAYS be re-installed. As @The Duck says, get into the habit of always saving stuff to an external drive, and make sure to disconnect it whenever you're not using it. You move it several yards away from the machine, that's an 'airgap' even specialised malware will never exploit in a million years.

3. We're gold with ROX-filer in Puppyland. When you delete a file with ROX, it's GONE. If you want the possibility to recover what you've removed, you need to remember to chuck it in the 'trash'.....itself a ROX-app put together by a veteran community member who's long since departed.


Mike.

 

[Condobloke]

For those interested, Rox-filer is also available in the Software Manager of Linux Mint

 

[ron.alan]

So Rox-filer overwrites deleted files?