Securely Cleaning Disk Free Space

Overview

When a user deletes a file, the file is not deleted. Rather, all references to the file are removed. This prevents the user from accessing the file through the usual means. However a resourceful intruder can ask the contents of "deleted" files. Even as the filesystem overwrites the deleted file, this does not protect the contents from being read by an intruder. The only through the use of a tool such as shred or nrm can you be be reasonably certain of the file being deleted.

While these tools are nice resources, they are not available on all platforms (read Windows) and not all programs are set to use these utilities. This means there is a good chance deleted files exist in somewhere in the free space of your disk. You need a tool which would operate as a"shred" for the free space of your disk. If you use a Windows, the tool of choice would be Eraser. However, Eraser only supports FAT32 and NTFS file systems. This means it can not handle most Nix based file systems (ext2, ext3, XFS and ReiserFSv3). Fortunately there is a tool which handles this, wipefreespace . As an added bonus, wipefreespace can handle NTFS. This means you can wipe the free space of your NTFS partition on the dual boot system while never leaving your Nix OS.

Installing Wipefreespace

There are three options for installing wipefreespace: source install, RPM or source RPM. The instructions for a source install are included in the INSTALL file in the tarball. For installations of wipefreespace 0.8 on Fedora Core 9 some changes to the install procedures are needed. These changes are detailed here.

Using Wipefreespace

There are a couple of important notes to remember when using wipefreespace. First and foremost, backup your data before using the program. While wipefreespace has been tested, it may contain bugs. Secondly, wipefreespace will not run on a device/partition which is mounted read-write. You will need to ensure the desired partition is mounted read-only. The below example demonstrates using wipefreespace to wipe the free space of an NTFS partition (dev/hda1).

% sudo wipefreespace -v /dev/hda1

The "-v" option tells wipefreespace to provide verbose output for its operation. This option and the rest are included in the wipefreespace man page. Note, the wiping of free space may take a long time depending on the size of the free space and the number of passes. I recommended wiping free space during down time, coffee breaks or running the process in the background.