How to securely erase from usb & flash drves in

English Applications
#1

Hi,

I’ve been switching between Linux distro’s for quite a while now and have settled on Opensuse (13.1 KDE 64 bit).

On one of the other distro’s that i’ve used in the past i ran ‘photorec’ on the SD card from my digital camera and was amazed how easily i could recover my old photos that i’d deleted. Since then i’d been formatting the cards in the gnome partition editor (if my memory serves me correctly you can tell it to overwrite the card with '0’s) and that seemed to do the trick - i couldn’t recover any files using photorec any more.

Now that i’ve switched to Opensuse, how can i make the photos that i’ve deleted from my SD card unrecoverable?

Thanks!

Ken

#2

Delete just one file and overwrite it a bunch: use the ‘shred’ command for
the deletion from the command line.

Clean off any old given media: dd if=/dev/urandom of=/dev/usbHere
This one requires being ‘root’, and if you typo something and put in your
real hard drive you’ll be done (broken/toast) before you realize it.

–
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below…

#3

Hi Ken and welcome!

You can use wipe from the OSS repo.

Have a lot of fun!

Kasi

#4

On 2013-12-09 21:56, ken300 wrote:

> Now that i’ve switched to Opensuse, how can i make the photos that i’ve
> deleted from my SD card unrecoverable?

There are many ways.

You can just fill the device with zeros:


cp /dev/zero /dev/device_name

or fill it with fast random data:


cp /dev/urandom /dev/device_name

or fill it with real random data (takes ages):


cp /dev/random /dev/device_name

Be real sure you don’t put the wrong device or you will destroy
something else, like your good filesystem.

–
Cheers / Saludos,

Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)

#5

On Mon, 09 Dec 2013 20:56:02 +0000, ken300 wrote:

> Now that i’ve switched to Opensuse, how can i make the photos that i’ve
> deleted from my SD card unrecoverable?

An easy way is to overwrite the unused space with zeros or random data.

dd if=/dev/zero of=/path/to/mounted/filesystem/file.tmp

or

dd if=/dev/urandom of=/path/to/mounted/filesystem/file.tmp

This doesn’t require you be root, nor does it risk wiping undeleted
data. Just let it run until the device is full, then delete the
“file.tmp” file that’s been created.

Jim

–
Jim Henderson
openSUSE Forums Administrator
Forum Use Terms & Conditions at http://tinyurl.com/openSUSE-T-C

#6

On 2013-12-10 00:46, Jim Henderson wrote:
> This doesn’t require you be root, nor does it risk wiping undeleted
> data. Just let it run until the device is full, then delete the
> “file.tmp” file that’s been created.

Good point…

–
Cheers / Saludos,

Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)

#7

I’m going to use this topic because it has similarities to my own thinking.

From time to time I would take my external drives over to my windows machine to do a format of some sort. I’m not all that interested in formatting as I am writing all zero’s to the drive. If I navigate to yast partition manager, how would one go about writing zero’s to the drive.

I don’t know anything about konsole or terminal, so let’s leave that one out for the moment.

#8

Thanks for all your suggestions, I particularly like 'hendersj’s suggestion so I’m in the process of trying it out, I’ll get back when I’m finished creating files, deleting & trying to recover them!

#9

Hi, just a small question - can I be sure that this will work on flashdrives despite the wear levelling algorythm in the controller? Lenwolf

#10

On 2013-12-10 19:46, lenwolf wrote:
>
> ab;2606758 Wrote:
>> Delete just one file and overwrite it a bunch: use the ‘shred’ command
>> for the deletion from the command line.

> Hi, just a small question - can I be sure that this will work on
> flashdrives despite the wear levelling algorythm in the controller?

Probably not.

–
Cheers / Saludos,

Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)

#11

On 2013-12-10 17:46, mike7757 wrote:

> I don’t know anything about konsole or terminal, so let’s leave that one
> out for the moment.

Dunno. I only know the terminal way, as told here.

–
Cheers / Saludos,

Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)

#12

A single pass should be enough for flash memory. Some methods use multiple passes because magnetic media leaks info to between tracks. But multiple passes could be detrimental to flash because of the ware factor. Also memory sticks do ot have the sophisticated algorithms to level ware and do not have an abundance (or any) of the extra memory as in a ssd. Thus they have much shorter lives by definition.

#13

This is the one that I would like to learn. I could probably do the most of it, but I don’t know how to find the device name.

#14

Put the device in and then in a konsole type mount

that will list all mounted devices you should be able to see the devices for the stick you put in by the name of the stick

Note that is will give a partition location so for the device drop the last number

ie sdc1 is mounted but the device is sdc the one is a partition number

#15

OK, thanks.

Also memory sticks do ot have the sophisticated algorithms to level ware
That seems to depend on the manufacturer, see .eg. Which USB flash drives use static wear levelling? - The Corsair Support Forums Lenwolf

#16

It is not something I’d count on. Also Id expect those sticks to sell at a premium

#17

Hi, do

 mount >~/before.txt

before you plug in the device. Then plug it in.
Now do

 
mount >~/after.txt 
diff ~/before.txt ~/after.txt

which will show you which device you plugged in.
HTH
Lenwolf

#18

Just to say thanks for all those who replied to my initial question, after some messing about i’ve come to the conclusion that the terminal command:

dd if=/dev/zero of=/path/to/mounted/filesystem/file.tmp

works exactly as i want - thanks hendersj

I had an issue where it was saying the card was full even though it wasn’t and then the CPU racing away at 100%, and then i realised that the card was 8gb and in FAT the files can’t be any more than 4gb-ish, Once i’d twigged that it went perfectly - Doh!!!

#19

On 2013-12-11 04:46, mike7757 wrote:

> This is the one that I would like to learn. I could probably do the most
> of it, but I don’t know how to find the device name.

Well, again, many ways. :slight_smile:

For instance, you open a terminal and run:


sudo tailf /var/log/messages

then you plug in the device (if it is connected, umount, remove, connect
again). You will see in the text that gets printed in the terminal the
device name.

Or instead of that command in the terminal, you run, after connect,
“dmesg” in a terminal. The text is long, but the end of it should be the
same messages.

–
Cheers / Saludos,

Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)

#20

On 2013-12-11 13:36, ken300 wrote:

> I had an issue where it was saying the card was full even though it
> wasn’t and then the CPU racing away at 100%, and then i realised that
> the card was 8gb and in FAT the files can’t be any more than 4gb-ish,
> Once i’d twigged that it went perfectly - Doh!!!

Ah, just write two or three files, different names, that’s all.

–
Cheers / Saludos,

Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)