Why does PHOTOREC keep finding files?Finding modified date and time of file from recovered disk imageHow are...

What will happen if I transfer large sums of money into my bank account from a pre-paid debit card or gift card?

Non-Cancer terminal illness that can affect young (age 10-13) girls?

Current across a wire with zero potential difference

Why are the books in the Game of Thrones citadel library shelved spine inwards?

Removing whitespace between consecutive numbers

Bash script to truncate subject line of incoming email

Treasure Hunt Riddle

In Linux what happens if 1000 files in a directory are moved to another location while another 300 files were added to the source directory?

TikZ graph edges not drawn nicely

Separate environment for personal and development use under macOS

Why is it that Bernie Sanders is always called a "socialist"?

Updating Statistics: Estimated Number of Rows not equal to Actual for Index Scan. Why?

How would an AI self awareness kill switch work?

How would you say "I like to go bowling" and other suru verbs?

Why does PHOTOREC keep finding files?

How do you funnel food off a cutting board?

Why did Luke use his left hand to shoot?

Can 5 Aarakocra PCs summon an Air Elemental?

Can the "Friends" spell be used without making the target hostile?

What happens when the wearer of a Shield of Missile Attraction is behind total cover?

What is a DAG (Graph Theory)?

A starship is travelling at 0.9c and collides with a small rock. Will it leave a clean hole through, or will more happen?

Why would space fleets be aligned?

Why is there a prohibition of gevinat aku"m?



Why does PHOTOREC keep finding files?


Finding modified date and time of file from recovered disk imageHow are files or chunks delimited on disk?How to scan a hard disk at low level to recover files in partially overwritten partition?Unix - way to see all files that recently got permissions changedextundelete - How to solve 'Block bitmap checksum does not match bitmap when trying to examine filesystem'?













1















Before I lend my laptop for a while to my young and linux-savy nephew I want to make sure he's not able to carve into my personal data in the blank space of the drive. I have saturated the blank space in the drive several times with




sudo cat /dev/urandom > goddamnit




Note the use of sudo, so that the 5% blank space reserved is ignored and the file grows until there is an error.



However, I execute photorec in that partition and then hundreds of old files pop out into existence. So, at least out of curiosity, where are those files stored and why does the random noise not overwrite them?



(The only explanation I have so far is, they might be in the empty space between the end of a file and the end of the sector that contains it. Could that be?)










share|improve this question

























  • @JeffSchaller thanks, at least I'm not alone, makes me feel better ;-)

    – frostschutz
    1 hour ago











  • Just wanted to focus on the core of the question...

    – Jeff Schaller
    1 hour ago











  • @JeffSchaller it does not open the file as superuser, but it does write to it as superuser.

    – Uncle Billy
    54 mins ago











  • @Mephisto some filesystems store the content of small files and directories directly in the free space from the inode. Or at least so was my impression -- I'll have to check ;-)

    – Uncle Billy
    51 mins ago


















1















Before I lend my laptop for a while to my young and linux-savy nephew I want to make sure he's not able to carve into my personal data in the blank space of the drive. I have saturated the blank space in the drive several times with




sudo cat /dev/urandom > goddamnit




Note the use of sudo, so that the 5% blank space reserved is ignored and the file grows until there is an error.



However, I execute photorec in that partition and then hundreds of old files pop out into existence. So, at least out of curiosity, where are those files stored and why does the random noise not overwrite them?



(The only explanation I have so far is, they might be in the empty space between the end of a file and the end of the sector that contains it. Could that be?)










share|improve this question

























  • @JeffSchaller thanks, at least I'm not alone, makes me feel better ;-)

    – frostschutz
    1 hour ago











  • Just wanted to focus on the core of the question...

    – Jeff Schaller
    1 hour ago











  • @JeffSchaller it does not open the file as superuser, but it does write to it as superuser.

    – Uncle Billy
    54 mins ago











  • @Mephisto some filesystems store the content of small files and directories directly in the free space from the inode. Or at least so was my impression -- I'll have to check ;-)

    – Uncle Billy
    51 mins ago
















1












1








1








Before I lend my laptop for a while to my young and linux-savy nephew I want to make sure he's not able to carve into my personal data in the blank space of the drive. I have saturated the blank space in the drive several times with




sudo cat /dev/urandom > goddamnit




Note the use of sudo, so that the 5% blank space reserved is ignored and the file grows until there is an error.



However, I execute photorec in that partition and then hundreds of old files pop out into existence. So, at least out of curiosity, where are those files stored and why does the random noise not overwrite them?



(The only explanation I have so far is, they might be in the empty space between the end of a file and the end of the sector that contains it. Could that be?)










share|improve this question
















Before I lend my laptop for a while to my young and linux-savy nephew I want to make sure he's not able to carve into my personal data in the blank space of the drive. I have saturated the blank space in the drive several times with




sudo cat /dev/urandom > goddamnit




Note the use of sudo, so that the 5% blank space reserved is ignored and the file grows until there is an error.



However, I execute photorec in that partition and then hundreds of old files pop out into existence. So, at least out of curiosity, where are those files stored and why does the random noise not overwrite them?



(The only explanation I have so far is, they might be in the empty space between the end of a file and the end of the sector that contains it. Could that be?)







forensics






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited 1 hour ago







Mephisto

















asked 2 hours ago









MephistoMephisto

286214




286214













  • @JeffSchaller thanks, at least I'm not alone, makes me feel better ;-)

    – frostschutz
    1 hour ago











  • Just wanted to focus on the core of the question...

    – Jeff Schaller
    1 hour ago











  • @JeffSchaller it does not open the file as superuser, but it does write to it as superuser.

    – Uncle Billy
    54 mins ago











  • @Mephisto some filesystems store the content of small files and directories directly in the free space from the inode. Or at least so was my impression -- I'll have to check ;-)

    – Uncle Billy
    51 mins ago





















  • @JeffSchaller thanks, at least I'm not alone, makes me feel better ;-)

    – frostschutz
    1 hour ago











  • Just wanted to focus on the core of the question...

    – Jeff Schaller
    1 hour ago











  • @JeffSchaller it does not open the file as superuser, but it does write to it as superuser.

    – Uncle Billy
    54 mins ago











  • @Mephisto some filesystems store the content of small files and directories directly in the free space from the inode. Or at least so was my impression -- I'll have to check ;-)

    – Uncle Billy
    51 mins ago



















@JeffSchaller thanks, at least I'm not alone, makes me feel better ;-)

– frostschutz
1 hour ago





@JeffSchaller thanks, at least I'm not alone, makes me feel better ;-)

– frostschutz
1 hour ago













Just wanted to focus on the core of the question...

– Jeff Schaller
1 hour ago





Just wanted to focus on the core of the question...

– Jeff Schaller
1 hour ago













@JeffSchaller it does not open the file as superuser, but it does write to it as superuser.

– Uncle Billy
54 mins ago





@JeffSchaller it does not open the file as superuser, but it does write to it as superuser.

– Uncle Billy
54 mins ago













@Mephisto some filesystems store the content of small files and directories directly in the free space from the inode. Or at least so was my impression -- I'll have to check ;-)

– Uncle Billy
51 mins ago







@Mephisto some filesystems store the content of small files and directories directly in the free space from the inode. Or at least so was my impression -- I'll have to check ;-)

– Uncle Billy
51 mins ago












3 Answers
3






active

oldest

votes


















3














There may be several misunderstandings here, so the command does not do what you perhaps expect it to.



sudo is superfluous since you don't need sudo to read from /dev/urandom. The > goddamnit part is a shell redirection and thus not covered by sudo at all. So your sudo is super uneffective. (Note: in this particular case, sudo might work as intended regardless, see comments. However, not using sudo this way is a pattern as it bites you in other cases.)



Then, you're writing into a regular file. That does fill up free space - of the filesystem that file happens to reside on. If you have multiple filesystems (one for /, one for /home, boot and swap partitions, etc.) then those are also unaffected.



At best this only overwrites free space. There is no guarantee that it will cover everything (depends on filesystem internals, root reserve, journal, otherwise packed/reserved/etc. sectors), and it does not overwrite any file that is still there regularly (and those can include files hidden away in trashcan / thumbnail / cache folders or just some subdir you forgot about).



All of those will still be picked up by photorec since it's never overwritten.



Furthermore, writing this file has to be completed first. So instead of deleting it directly afterwards, you'd have to sync first to make sure all that random data actually hit the disk, and not just some RAM write buffer and never gets written.



So with this method, there is no guarantee for anything. At the same time it's dangerous, as the filesystem will run out of free space, which in turn can cause write failures for all other programs and thus result in unintentional data loss.






share|improve this answer


























  • The sudo is there to ensure writing to the 5% (or some similar amount) reserved space, otherwise it will stop writing at the same time when the normal user file browsers report 0 bytes. With sudo, it does write an additional 50 GB more or less, don't ask me why.

    – Mephisto
    1 hour ago











  • @Mephisto I admit I haven't tested it ( difficult for me since sudo is not installed here ) so I could be wrong about it, and shell redirection only is a problem when trying to write to a file already owned by root ( no permission to open / append as that's done by the shell before sudo runs ).

    – frostschutz
    1 hour ago








  • 1





    I confirm, we were wrong about the reserved space not filling up: what matters is the EUID of the file doing the writing, not the ownership of the file. It makes sense in retrospect — the way the restriction works is that the kernel returns ENOSPC on the write call, and the exception is based on who called write.

    – Gilles
    1 hour ago











  • Thanks for confirming, I'd still argue it's bad style to use sudo this way, as it gives the wrong idea about how sudo normally works when writing to files. (I'd also argue that writing random data is better than writing zero, you never know if the filesystem or storage device compresses/deduplicates data.)

    – frostschutz
    1 hour ago



















2














Try using the sfill (Secure fill) tool in secure delete.



sudo apt-get install secure-delete


(from https://superuser.com/questions/19326/how-to-wipe-free-disk-space-in-linux )






share|improve this answer
























  • This does not answer the question, which asks “why”.

    – Gilles
    1 hour ago











  • But that thing, acording to man sfill will do a lot of passes of zeros, noise and special values. This is overwriting the same area I overwrite with one (actually 4 by now) pass. Those files must be stored somewhere else.

    – Mephisto
    1 hour ago











  • Well, I would say it's overwriting the area you intend to overwrite but are not quite successfully overwriting.

    – L. Scott Johnson
    1 hour ago



















0














How to get rid of all data, that your nephew should not see



I think there is only one way that is likely to overwrite all the locations, where 'deleted' data might remain.




  • Backup your system (a complete backup). One alternative is to make a cloned image with Clonezilla.


  • Wipe the whole drive (assuming one drive). If an HDD or SSD, there are special tools/methods, that work at a low level (change the mapping between logical and physical memory locations), and they are much faster than for example letting dd overwrite with zeros. You can often access such tools (built-in the drives) via hdparm.


  • Make a fresh installation and hand over the computer to the young and linux-savvy nephew.



The easy way



But if you can afford it, unplug your internal drive and replace it with a fresh drive. Let your nephew install his favourite linux distro :-)






share|improve this answer























    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "106"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: false,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f503184%2fwhy-does-photorec-keep-finding-files%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    3 Answers
    3






    active

    oldest

    votes








    3 Answers
    3






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    3














    There may be several misunderstandings here, so the command does not do what you perhaps expect it to.



    sudo is superfluous since you don't need sudo to read from /dev/urandom. The > goddamnit part is a shell redirection and thus not covered by sudo at all. So your sudo is super uneffective. (Note: in this particular case, sudo might work as intended regardless, see comments. However, not using sudo this way is a pattern as it bites you in other cases.)



    Then, you're writing into a regular file. That does fill up free space - of the filesystem that file happens to reside on. If you have multiple filesystems (one for /, one for /home, boot and swap partitions, etc.) then those are also unaffected.



    At best this only overwrites free space. There is no guarantee that it will cover everything (depends on filesystem internals, root reserve, journal, otherwise packed/reserved/etc. sectors), and it does not overwrite any file that is still there regularly (and those can include files hidden away in trashcan / thumbnail / cache folders or just some subdir you forgot about).



    All of those will still be picked up by photorec since it's never overwritten.



    Furthermore, writing this file has to be completed first. So instead of deleting it directly afterwards, you'd have to sync first to make sure all that random data actually hit the disk, and not just some RAM write buffer and never gets written.



    So with this method, there is no guarantee for anything. At the same time it's dangerous, as the filesystem will run out of free space, which in turn can cause write failures for all other programs and thus result in unintentional data loss.






    share|improve this answer


























    • The sudo is there to ensure writing to the 5% (or some similar amount) reserved space, otherwise it will stop writing at the same time when the normal user file browsers report 0 bytes. With sudo, it does write an additional 50 GB more or less, don't ask me why.

      – Mephisto
      1 hour ago











    • @Mephisto I admit I haven't tested it ( difficult for me since sudo is not installed here ) so I could be wrong about it, and shell redirection only is a problem when trying to write to a file already owned by root ( no permission to open / append as that's done by the shell before sudo runs ).

      – frostschutz
      1 hour ago








    • 1





      I confirm, we were wrong about the reserved space not filling up: what matters is the EUID of the file doing the writing, not the ownership of the file. It makes sense in retrospect — the way the restriction works is that the kernel returns ENOSPC on the write call, and the exception is based on who called write.

      – Gilles
      1 hour ago











    • Thanks for confirming, I'd still argue it's bad style to use sudo this way, as it gives the wrong idea about how sudo normally works when writing to files. (I'd also argue that writing random data is better than writing zero, you never know if the filesystem or storage device compresses/deduplicates data.)

      – frostschutz
      1 hour ago
















    3














    There may be several misunderstandings here, so the command does not do what you perhaps expect it to.



    sudo is superfluous since you don't need sudo to read from /dev/urandom. The > goddamnit part is a shell redirection and thus not covered by sudo at all. So your sudo is super uneffective. (Note: in this particular case, sudo might work as intended regardless, see comments. However, not using sudo this way is a pattern as it bites you in other cases.)



    Then, you're writing into a regular file. That does fill up free space - of the filesystem that file happens to reside on. If you have multiple filesystems (one for /, one for /home, boot and swap partitions, etc.) then those are also unaffected.



    At best this only overwrites free space. There is no guarantee that it will cover everything (depends on filesystem internals, root reserve, journal, otherwise packed/reserved/etc. sectors), and it does not overwrite any file that is still there regularly (and those can include files hidden away in trashcan / thumbnail / cache folders or just some subdir you forgot about).



    All of those will still be picked up by photorec since it's never overwritten.



    Furthermore, writing this file has to be completed first. So instead of deleting it directly afterwards, you'd have to sync first to make sure all that random data actually hit the disk, and not just some RAM write buffer and never gets written.



    So with this method, there is no guarantee for anything. At the same time it's dangerous, as the filesystem will run out of free space, which in turn can cause write failures for all other programs and thus result in unintentional data loss.






    share|improve this answer


























    • The sudo is there to ensure writing to the 5% (or some similar amount) reserved space, otherwise it will stop writing at the same time when the normal user file browsers report 0 bytes. With sudo, it does write an additional 50 GB more or less, don't ask me why.

      – Mephisto
      1 hour ago











    • @Mephisto I admit I haven't tested it ( difficult for me since sudo is not installed here ) so I could be wrong about it, and shell redirection only is a problem when trying to write to a file already owned by root ( no permission to open / append as that's done by the shell before sudo runs ).

      – frostschutz
      1 hour ago








    • 1





      I confirm, we were wrong about the reserved space not filling up: what matters is the EUID of the file doing the writing, not the ownership of the file. It makes sense in retrospect — the way the restriction works is that the kernel returns ENOSPC on the write call, and the exception is based on who called write.

      – Gilles
      1 hour ago











    • Thanks for confirming, I'd still argue it's bad style to use sudo this way, as it gives the wrong idea about how sudo normally works when writing to files. (I'd also argue that writing random data is better than writing zero, you never know if the filesystem or storage device compresses/deduplicates data.)

      – frostschutz
      1 hour ago














    3












    3








    3







    There may be several misunderstandings here, so the command does not do what you perhaps expect it to.



    sudo is superfluous since you don't need sudo to read from /dev/urandom. The > goddamnit part is a shell redirection and thus not covered by sudo at all. So your sudo is super uneffective. (Note: in this particular case, sudo might work as intended regardless, see comments. However, not using sudo this way is a pattern as it bites you in other cases.)



    Then, you're writing into a regular file. That does fill up free space - of the filesystem that file happens to reside on. If you have multiple filesystems (one for /, one for /home, boot and swap partitions, etc.) then those are also unaffected.



    At best this only overwrites free space. There is no guarantee that it will cover everything (depends on filesystem internals, root reserve, journal, otherwise packed/reserved/etc. sectors), and it does not overwrite any file that is still there regularly (and those can include files hidden away in trashcan / thumbnail / cache folders or just some subdir you forgot about).



    All of those will still be picked up by photorec since it's never overwritten.



    Furthermore, writing this file has to be completed first. So instead of deleting it directly afterwards, you'd have to sync first to make sure all that random data actually hit the disk, and not just some RAM write buffer and never gets written.



    So with this method, there is no guarantee for anything. At the same time it's dangerous, as the filesystem will run out of free space, which in turn can cause write failures for all other programs and thus result in unintentional data loss.






    share|improve this answer















    There may be several misunderstandings here, so the command does not do what you perhaps expect it to.



    sudo is superfluous since you don't need sudo to read from /dev/urandom. The > goddamnit part is a shell redirection and thus not covered by sudo at all. So your sudo is super uneffective. (Note: in this particular case, sudo might work as intended regardless, see comments. However, not using sudo this way is a pattern as it bites you in other cases.)



    Then, you're writing into a regular file. That does fill up free space - of the filesystem that file happens to reside on. If you have multiple filesystems (one for /, one for /home, boot and swap partitions, etc.) then those are also unaffected.



    At best this only overwrites free space. There is no guarantee that it will cover everything (depends on filesystem internals, root reserve, journal, otherwise packed/reserved/etc. sectors), and it does not overwrite any file that is still there regularly (and those can include files hidden away in trashcan / thumbnail / cache folders or just some subdir you forgot about).



    All of those will still be picked up by photorec since it's never overwritten.



    Furthermore, writing this file has to be completed first. So instead of deleting it directly afterwards, you'd have to sync first to make sure all that random data actually hit the disk, and not just some RAM write buffer and never gets written.



    So with this method, there is no guarantee for anything. At the same time it's dangerous, as the filesystem will run out of free space, which in turn can cause write failures for all other programs and thus result in unintentional data loss.







    share|improve this answer














    share|improve this answer



    share|improve this answer








    edited 1 hour ago

























    answered 1 hour ago









    frostschutzfrostschutz

    27.2k15584




    27.2k15584













    • The sudo is there to ensure writing to the 5% (or some similar amount) reserved space, otherwise it will stop writing at the same time when the normal user file browsers report 0 bytes. With sudo, it does write an additional 50 GB more or less, don't ask me why.

      – Mephisto
      1 hour ago











    • @Mephisto I admit I haven't tested it ( difficult for me since sudo is not installed here ) so I could be wrong about it, and shell redirection only is a problem when trying to write to a file already owned by root ( no permission to open / append as that's done by the shell before sudo runs ).

      – frostschutz
      1 hour ago








    • 1





      I confirm, we were wrong about the reserved space not filling up: what matters is the EUID of the file doing the writing, not the ownership of the file. It makes sense in retrospect — the way the restriction works is that the kernel returns ENOSPC on the write call, and the exception is based on who called write.

      – Gilles
      1 hour ago











    • Thanks for confirming, I'd still argue it's bad style to use sudo this way, as it gives the wrong idea about how sudo normally works when writing to files. (I'd also argue that writing random data is better than writing zero, you never know if the filesystem or storage device compresses/deduplicates data.)

      – frostschutz
      1 hour ago



















    • The sudo is there to ensure writing to the 5% (or some similar amount) reserved space, otherwise it will stop writing at the same time when the normal user file browsers report 0 bytes. With sudo, it does write an additional 50 GB more or less, don't ask me why.

      – Mephisto
      1 hour ago











    • @Mephisto I admit I haven't tested it ( difficult for me since sudo is not installed here ) so I could be wrong about it, and shell redirection only is a problem when trying to write to a file already owned by root ( no permission to open / append as that's done by the shell before sudo runs ).

      – frostschutz
      1 hour ago








    • 1





      I confirm, we were wrong about the reserved space not filling up: what matters is the EUID of the file doing the writing, not the ownership of the file. It makes sense in retrospect — the way the restriction works is that the kernel returns ENOSPC on the write call, and the exception is based on who called write.

      – Gilles
      1 hour ago











    • Thanks for confirming, I'd still argue it's bad style to use sudo this way, as it gives the wrong idea about how sudo normally works when writing to files. (I'd also argue that writing random data is better than writing zero, you never know if the filesystem or storage device compresses/deduplicates data.)

      – frostschutz
      1 hour ago

















    The sudo is there to ensure writing to the 5% (or some similar amount) reserved space, otherwise it will stop writing at the same time when the normal user file browsers report 0 bytes. With sudo, it does write an additional 50 GB more or less, don't ask me why.

    – Mephisto
    1 hour ago





    The sudo is there to ensure writing to the 5% (or some similar amount) reserved space, otherwise it will stop writing at the same time when the normal user file browsers report 0 bytes. With sudo, it does write an additional 50 GB more or less, don't ask me why.

    – Mephisto
    1 hour ago













    @Mephisto I admit I haven't tested it ( difficult for me since sudo is not installed here ) so I could be wrong about it, and shell redirection only is a problem when trying to write to a file already owned by root ( no permission to open / append as that's done by the shell before sudo runs ).

    – frostschutz
    1 hour ago







    @Mephisto I admit I haven't tested it ( difficult for me since sudo is not installed here ) so I could be wrong about it, and shell redirection only is a problem when trying to write to a file already owned by root ( no permission to open / append as that's done by the shell before sudo runs ).

    – frostschutz
    1 hour ago






    1




    1





    I confirm, we were wrong about the reserved space not filling up: what matters is the EUID of the file doing the writing, not the ownership of the file. It makes sense in retrospect — the way the restriction works is that the kernel returns ENOSPC on the write call, and the exception is based on who called write.

    – Gilles
    1 hour ago





    I confirm, we were wrong about the reserved space not filling up: what matters is the EUID of the file doing the writing, not the ownership of the file. It makes sense in retrospect — the way the restriction works is that the kernel returns ENOSPC on the write call, and the exception is based on who called write.

    – Gilles
    1 hour ago













    Thanks for confirming, I'd still argue it's bad style to use sudo this way, as it gives the wrong idea about how sudo normally works when writing to files. (I'd also argue that writing random data is better than writing zero, you never know if the filesystem or storage device compresses/deduplicates data.)

    – frostschutz
    1 hour ago





    Thanks for confirming, I'd still argue it's bad style to use sudo this way, as it gives the wrong idea about how sudo normally works when writing to files. (I'd also argue that writing random data is better than writing zero, you never know if the filesystem or storage device compresses/deduplicates data.)

    – frostschutz
    1 hour ago













    2














    Try using the sfill (Secure fill) tool in secure delete.



    sudo apt-get install secure-delete


    (from https://superuser.com/questions/19326/how-to-wipe-free-disk-space-in-linux )






    share|improve this answer
























    • This does not answer the question, which asks “why”.

      – Gilles
      1 hour ago











    • But that thing, acording to man sfill will do a lot of passes of zeros, noise and special values. This is overwriting the same area I overwrite with one (actually 4 by now) pass. Those files must be stored somewhere else.

      – Mephisto
      1 hour ago











    • Well, I would say it's overwriting the area you intend to overwrite but are not quite successfully overwriting.

      – L. Scott Johnson
      1 hour ago
















    2














    Try using the sfill (Secure fill) tool in secure delete.



    sudo apt-get install secure-delete


    (from https://superuser.com/questions/19326/how-to-wipe-free-disk-space-in-linux )






    share|improve this answer
























    • This does not answer the question, which asks “why”.

      – Gilles
      1 hour ago











    • But that thing, acording to man sfill will do a lot of passes of zeros, noise and special values. This is overwriting the same area I overwrite with one (actually 4 by now) pass. Those files must be stored somewhere else.

      – Mephisto
      1 hour ago











    • Well, I would say it's overwriting the area you intend to overwrite but are not quite successfully overwriting.

      – L. Scott Johnson
      1 hour ago














    2












    2








    2







    Try using the sfill (Secure fill) tool in secure delete.



    sudo apt-get install secure-delete


    (from https://superuser.com/questions/19326/how-to-wipe-free-disk-space-in-linux )






    share|improve this answer













    Try using the sfill (Secure fill) tool in secure delete.



    sudo apt-get install secure-delete


    (from https://superuser.com/questions/19326/how-to-wipe-free-disk-space-in-linux )







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered 1 hour ago









    L. Scott JohnsonL. Scott Johnson

    1805




    1805













    • This does not answer the question, which asks “why”.

      – Gilles
      1 hour ago











    • But that thing, acording to man sfill will do a lot of passes of zeros, noise and special values. This is overwriting the same area I overwrite with one (actually 4 by now) pass. Those files must be stored somewhere else.

      – Mephisto
      1 hour ago











    • Well, I would say it's overwriting the area you intend to overwrite but are not quite successfully overwriting.

      – L. Scott Johnson
      1 hour ago



















    • This does not answer the question, which asks “why”.

      – Gilles
      1 hour ago











    • But that thing, acording to man sfill will do a lot of passes of zeros, noise and special values. This is overwriting the same area I overwrite with one (actually 4 by now) pass. Those files must be stored somewhere else.

      – Mephisto
      1 hour ago











    • Well, I would say it's overwriting the area you intend to overwrite but are not quite successfully overwriting.

      – L. Scott Johnson
      1 hour ago

















    This does not answer the question, which asks “why”.

    – Gilles
    1 hour ago





    This does not answer the question, which asks “why”.

    – Gilles
    1 hour ago













    But that thing, acording to man sfill will do a lot of passes of zeros, noise and special values. This is overwriting the same area I overwrite with one (actually 4 by now) pass. Those files must be stored somewhere else.

    – Mephisto
    1 hour ago





    But that thing, acording to man sfill will do a lot of passes of zeros, noise and special values. This is overwriting the same area I overwrite with one (actually 4 by now) pass. Those files must be stored somewhere else.

    – Mephisto
    1 hour ago













    Well, I would say it's overwriting the area you intend to overwrite but are not quite successfully overwriting.

    – L. Scott Johnson
    1 hour ago





    Well, I would say it's overwriting the area you intend to overwrite but are not quite successfully overwriting.

    – L. Scott Johnson
    1 hour ago











    0














    How to get rid of all data, that your nephew should not see



    I think there is only one way that is likely to overwrite all the locations, where 'deleted' data might remain.




    • Backup your system (a complete backup). One alternative is to make a cloned image with Clonezilla.


    • Wipe the whole drive (assuming one drive). If an HDD or SSD, there are special tools/methods, that work at a low level (change the mapping between logical and physical memory locations), and they are much faster than for example letting dd overwrite with zeros. You can often access such tools (built-in the drives) via hdparm.


    • Make a fresh installation and hand over the computer to the young and linux-savvy nephew.



    The easy way



    But if you can afford it, unplug your internal drive and replace it with a fresh drive. Let your nephew install his favourite linux distro :-)






    share|improve this answer




























      0














      How to get rid of all data, that your nephew should not see



      I think there is only one way that is likely to overwrite all the locations, where 'deleted' data might remain.




      • Backup your system (a complete backup). One alternative is to make a cloned image with Clonezilla.


      • Wipe the whole drive (assuming one drive). If an HDD or SSD, there are special tools/methods, that work at a low level (change the mapping between logical and physical memory locations), and they are much faster than for example letting dd overwrite with zeros. You can often access such tools (built-in the drives) via hdparm.


      • Make a fresh installation and hand over the computer to the young and linux-savvy nephew.



      The easy way



      But if you can afford it, unplug your internal drive and replace it with a fresh drive. Let your nephew install his favourite linux distro :-)






      share|improve this answer


























        0












        0








        0







        How to get rid of all data, that your nephew should not see



        I think there is only one way that is likely to overwrite all the locations, where 'deleted' data might remain.




        • Backup your system (a complete backup). One alternative is to make a cloned image with Clonezilla.


        • Wipe the whole drive (assuming one drive). If an HDD or SSD, there are special tools/methods, that work at a low level (change the mapping between logical and physical memory locations), and they are much faster than for example letting dd overwrite with zeros. You can often access such tools (built-in the drives) via hdparm.


        • Make a fresh installation and hand over the computer to the young and linux-savvy nephew.



        The easy way



        But if you can afford it, unplug your internal drive and replace it with a fresh drive. Let your nephew install his favourite linux distro :-)






        share|improve this answer













        How to get rid of all data, that your nephew should not see



        I think there is only one way that is likely to overwrite all the locations, where 'deleted' data might remain.




        • Backup your system (a complete backup). One alternative is to make a cloned image with Clonezilla.


        • Wipe the whole drive (assuming one drive). If an HDD or SSD, there are special tools/methods, that work at a low level (change the mapping between logical and physical memory locations), and they are much faster than for example letting dd overwrite with zeros. You can often access such tools (built-in the drives) via hdparm.


        • Make a fresh installation and hand over the computer to the young and linux-savvy nephew.



        The easy way



        But if you can afford it, unplug your internal drive and replace it with a fresh drive. Let your nephew install his favourite linux distro :-)







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered 1 hour ago









        sudodussudodus

        1,54837




        1,54837






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Unix & Linux Stack Exchange!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f503184%2fwhy-does-photorec-keep-finding-files%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            “%fieldName is a required field.”, in Magento2 REST API Call for GET Method Type The Next...

            How to change City field to a dropdown in Checkout step Magento 2Magento 2 : How to change UI field(s)...

            變成蝙蝠會怎樣? 參考資料 外部連結 导航菜单Thomas Nagel, "What is it like to be a...