How to Securely Delete Files with Shred in Linux

When you delete a file using the standard rm command in Linux, the operating system merely unlinks the file pointer, leaving the underlying data intact on the storage drive until it is overwritten. This guide explains how to use the built-in shred utility to permanently and securely overwrite files so they cannot be recovered using data recovery tools, covering essential syntax, commonly used command-line options, and practical examples.

Understanding the shred Command

The shred command securely erases files by repeatedly overwriting their data blocks with patterns of random bits. By default, shred overwrites target data three times to ensure the original contents become unrecoverable.

Basic Syntax and Options

The basic structure of the command is:

shred [options] filename

The most common flags used with shred include:

• -u (or --remove): Deletes the file after overwriting it. Without this flag, the file remains on the system with overwritten contents.
• -z (or --zero): Performs a final overwrite with zeros to conceal the fact that the file was shredded.
• -v (or --verbose): Displays real-time progress of the overwrite passes.
• -n <number> (or --iterations=<number>): Specifies the number of overwrite cycles (default is 3).

Recommended Usage for Single Files

To securely overwrite a file, hide the shredding process, show progress, and remove the file from the filesystem upon completion, run:

shred -uvz -n 3 secret_file.txt

In this command:

• -u deletes the file after the operation finishes.
• -v outputs the progress pass by pass.
• -z writes all zeros in the final pass.
• -n 3 overwrites the file three times with random data before the zero pass.

Deleting Multiple Files

You can delete multiple specific files or target files using wildcards:

shred -uvz -n 3 document1.pdf document2.pdf
shred -uvz -n 3 *.log

Wiping an Entire Partition or Drive

The shred command can also target raw block devices, such as an entire hard drive partition or a USB flash drive.

Warning: Ensure the device path is correct, as this action is irreversible.

sudo shred -vz -n 1 /dev/sdb1

Omit the -u flag when targeting block devices, as you cannot unlink a physical partition.

Important Limitations

The shred utility relies on the assumption that the filesystem overwrites data in place. It may be less effective on:

• Log-structured or journaled filesystems: Filesystems like ext3 or ext4 operating in data=journal mode write metadata and data to a journal first.
• Copy-on-Write (CoW) filesystems: Filesystems such as Btrfs and ZFS write changes to new sectors rather than overwriting existing blocks.
• Solid-State Drives (SSDs): Wear-leveling mechanisms on SSDs distribute writes across different physical blocks, meaning shred may write to alternate locations rather than the original physical cell. For SSDs, hardware-level secure erase (such as ATA Secure Erase) is recommended.