{"id":341,"date":"2024-03-06T01:18:17","date_gmt":"2024-03-06T01:18:17","guid":{"rendered":"https:\/\/anti-forensics.com\/blog\/?p=341"},"modified":"2024-03-07T21:38:11","modified_gmt":"2024-03-07T21:38:11","slug":"simple-file-wiping-on-linux-using-shred-and-dd","status":"publish","type":"post","link":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/","title":{"rendered":"Simple File Wiping on Linux using shred and dd"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Simple File Wiping<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is a demo of creating a file, writing a filesystem to that file, mounting this filesystem, performing operations, including deletion and wiping of data. Then viewing the results to understand what has happened to the data after wiping. Linux shred, rm, and dd are used for file deletion and data wiping.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Software<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><code>dd<\/code> &#8211; is a powerful command-line utility in Linux used for copying and converting data with precise control over input and output parameters. It operates at the block level, making it versatile for tasks such as disk cloning, disk imaging, and low-level data manipulation. With <code>dd<\/code>, you can specify input and output files or devices, block sizes, byte offsets, and data transfer rates, offering granular control over data operations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>shred<\/code> &#8211; is a command-line utility designed for securely deleting files by overwriting their contents with random data, making it virtually impossible to recover the original data. It&#8217;s commonly used to ensure sensitive information cannot be retrieved from storage media once deleted. <strong><code>shred<\/code> <\/strong>offers various options for customization, such as specifying the number of overwrite passes, the method of overwriting (random data or zeros), and whether to remove the file after shredding. This tool is particularly useful in situations where data confidentiality is paramount, such as when disposing of storage devices or securely erasing sensitive files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>rm<\/code> &#8211; is a command-line utility used for removing files and directories from the filesystem. It is a fundamental tool for file management in Unix-like operating systems. By default, <code>rm<\/code> deletes files without any confirmation prompts, making it efficient for batch operations. However, it also offers several options for more controlled deletion, such as prompting for confirmation before removal (<code>-i<\/code>), recursively deleting directories and their contents (<code>-r<\/code>), and forcibly removing files without prompting (<code>-f<\/code>). While <code>rm<\/code> is a powerful tool, caution is advised when using it to prevent accidental deletion of important files.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Setup<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The goal is to create an empty file, create a filesystem, mount the filesystem, and run a variety of file creation, file deletion, and file wiping techniques. The results are then viewed at the end.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use <code>dd<\/code> to create a zero-filled file named <code>data01<\/code>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ dd if=\/dev\/zero of=data01 count=1 bs=512M        \r\n1+0 records in\r\n1+0 records out\r\n536870912 bytes (537 MB, 512 MiB) copied, 1.47341 s, 364 MB\/s\r<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>count<\/code> switch is used to specify how many blocks of data should be written. The <code>bs<\/code> switch specifies how large each block is in &#8220;M&#8221; or MiB&#8217;s. Together, these options are used to create a single 512MiB file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-rw-r--r--  1 user user 512M Mar  5 15:33 data01\r<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Next, use <code>mkfs.exfat data01<\/code> to write the exfat file system to the file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ mkfs.exfat data01\r\nexfatprogs version : 1.2.2\r\nCreating exFAT filesystem(data01, cluster size=32768)\r\n\r\nWriting volume boot record: done\r\nWriting backup volume boot record: done\r\nFat table creation: done\r\nAllocation bitmap creation: done\r\nUpcase table creation: done\r\nWriting root directory entry: done\r\nSynchronizing...\r\n\r\nexFAT format complete!<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify that the file system has been written using <code>hexdump<\/code> with the <code>-C<\/code> option. This option sets output to be a: canonical hex+ASCII display as seen below.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\n\u2514\u2500$ hexdump -C data01 \n00000000  eb 76 90 45 58 46 41 54  20 20 20 00 00 00 00 00  |.v.EXFAT   .....|\n00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now mount the file as a loop device using <code>losetup<\/code>. First, use the <code>-f<\/code> switch to look for the first available loop node.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ losetup -f\r\n\/dev\/loop0<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The next available loop node is <code>\/dev\/loop0<\/code>. Next, mount the file as a loop device (create loop device).<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ sudo losetup \/dev\/loop0 data01\r<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify the loop device(s) using <code>losetup -a<\/code> to list all used devices. The loop device that was created should be listed.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ losetup -a\r\n\/dev\/loop0: &#91;]: (\/home\/user\/demo\/data01)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Next, mount the loop device (in this case &#8220;\/mnt&#8221; is used as the destination).<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ sudo mount \/dev\/loop0 \/mnt\n\n$ mount\n\/dev\/loop0 on \/mnt type exfat (rw,relatime,fmask=0022,dmask=0022,iocharset=utf8,errors=remount-ro)\n\n$ df -h\n\/dev\/loop0      510M   96K  510M   1% \/mnt\r\n\r<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Create two files on the mounted filesystem. The first, &#8220;test&#8221; with &#8220;TEST456&#8221; as the content. Another, &#8220;best&#8221; with &#8220;BEST123&#8221; as the content.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Verify the content using GNU <code>strings<\/code>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ strings data01\nEXFAT   \nEXFAT \nBEST123\r\nb0VIM 9.1\r\nroot\r\n\/mnt\/test\r\nutf-8\r\nU3210\r\n#\"! \r\nTEST456\r\nEFI PART\r\nziD|\r\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Next, delete the test file using <code>rm<\/code>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ sudo rm \/mnt\/test <\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Running the <code>strings<\/code> command will show that the data still exists.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ strings data01\nEXFAT   \nEXFAT \nBEST123\r\nb0VIM 9.1\r\nroot\r\n\/mnt\/test\r\nutf-8\r\nU3210\r\n#\"! \r\nTEST456\r\nEFI PART\r\nziD|\n\n---\n\n\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ ls -l \/mnt  \r\ntotal 32\r\n-rwxr-xr-x 1 root root 8 Mar  5 16:43 best\n\r<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">The Shredding<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Now, using the <code>shred<\/code> command, delete the &#8220;best&#8221; file. We use the <code>-u<\/code> switch to remove the file after shred, and the <code>-z<\/code> switch to zero-fill the file. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Below, notice that the file contents are now gone. Also notice that the &#8220;TEST456&#8221; associated content that was deleted through <code>rm<\/code> still exists on the drive.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ sudo shred -u -z \/mnt\/best\r\n\n\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ strings data01 \nEXFAT   \nEXFAT \nb0VIM 9.1\r\nroot\r\n\/mnt\/test\r\nutf-8\r\nU3210\r\n#\"! \r\nTEST456\r\nEFI PART\r\nziD|\r\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">The Wiping<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After successfully wiping (shred) the &#8220;best&#8221; file, the free disk space will be zero-filled using <code>dd<\/code> in order to erase the deleted file data (&#8220;TEST456&#8221;) for the old &#8220;test&#8221; file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use <code>dd<\/code> to wipe free space on the file system.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ sudo dd if=\/dev\/zero of=\/mnt\/BIGFILETOWIPEFREESPACE\r\ndd: writing to '\/mnt\/BIGFILETOWIPEFREESPACE': No space left on device\r\n1044289+0 records in\r\n1044288+0 records out\r\n534675456 bytes (535 MB, 510 MiB) copied, 7.99443 s, 66.9 MB\/s\n\n\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ strings data01                                     \r\nEXFAT   \r\nEXFAT <\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Run the strings command again on the data01 file and notice that all of the plaintext file content has been overwritten in free space.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">So it&#8217;s done! &#8230; Not quite.<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use the strings command again, but specify the encoding option <code>strings data01 -e {b,l}<\/code>. Remember when the &#8220;test&#8221; file was deleted? The <code>rm<\/code> command was used, not <code>shred<\/code>. The file name data still resides in the file table and is recoverable because of this.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(user\u327fnox)-&#91;~\/demo]\r\n\u2514\u2500$ strings -e {b,l} data01\r\r\n\rAtest<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>-e<\/code> switch is for the encoding selection. Used here is the 16-bit encoding selection<code>{b,l}<\/code>. This way the data residing in the file table can be displayed.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Use the strings command again, but specify the encoding option strings data01 -e {b,l}. Remember when the &#8220;test&#8221; file was deleted? The rm command was used, not shred. The file name data still resides in the file table and is recoverable because of this.<\/p>\n","protected":false},"author":1,"featured_media":356,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,22],"tags":[55,51,54,52,53],"class_list":["post-341","post","type-post","status-publish","format-standard","has-post-thumbnail","category-anti-forensics","category-digital-forensics","tag-anti-forensics","tag-dd","tag-linux","tag-rm","tag-shred"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Simple File Wiping on Linux using shred and dd - Anti-Forensics.com<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Simple File Wiping on Linux using shred and dd - Anti-Forensics.com\" \/>\n<meta property=\"og:description\" content=\"Use the strings command again, but specify the encoding option strings data01 -e {b,l}. Remember when the &quot;test&quot; file was deleted? The rm command was used, not shred. The file name data still resides in the file table and is recoverable because of this.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/\" \/>\n<meta property=\"og:site_name\" content=\"Anti-Forensics.com\" \/>\n<meta property=\"article:author\" content=\"https:\/\/facebook.com\/stercutis\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-06T01:18:17+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-03-07T21:38:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/03\/anti-forensics.com-linux-dd-shred-rm.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Max\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Max\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/\"},\"author\":{\"name\":\"Max\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/ac3dd160cb42b1409a2a55dea58beec2\"},\"headline\":\"Simple File Wiping on Linux using shred and dd\",\"datePublished\":\"2024-03-06T01:18:17+00:00\",\"dateModified\":\"2024-03-07T21:38:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/\"},\"wordCount\":735,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/anti-forensics.com-linux-dd-shred-rm.jpg\",\"keywords\":[\"anti-forensics\",\"dd\",\"linux\",\"rm\",\"shred\"],\"articleSection\":[\"Anti-Forensics\",\"Digital Forensics\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/\",\"name\":\"Simple File Wiping on Linux using shred and dd - Anti-Forensics.com\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/anti-forensics.com-linux-dd-shred-rm.jpg\",\"datePublished\":\"2024-03-06T01:18:17+00:00\",\"dateModified\":\"2024-03-07T21:38:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/#primaryimage\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/anti-forensics.com-linux-dd-shred-rm.jpg\",\"contentUrl\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/anti-forensics.com-linux-dd-shred-rm.jpg\",\"width\":1024,\"height\":1024},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/simple-file-wiping-on-linux-using-shred-and-dd\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Simple File Wiping on Linux using shred and dd\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/\",\"name\":\"Anti-Forensics.com\",\"description\":\"Rendering Digital Investigations Irrelevant\",\"publisher\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#organization\",\"name\":\"Anti-Forensics.com\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/cropped-anti-forensics.com_.jpg\",\"contentUrl\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/cropped-anti-forensics.com_.jpg\",\"width\":512,\"height\":512,\"caption\":\"Anti-Forensics.com\"},\"image\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/groups\\\/14345620\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/ac3dd160cb42b1409a2a55dea58beec2\",\"name\":\"Max\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g\",\"caption\":\"Max\"},\"description\":\"Anti-forensics involves attempts to hide data, damage the confidentiality, integrity, and availability of data in an effort to make analysis and examination of this data (evidence) difficult or impossible.\",\"sameAs\":[\"https:\\\/\\\/anti-forensics.com\\\/blog\",\"https:\\\/\\\/facebook.com\\\/stercutis\",\"https:\\\/\\\/linkedin.com\\\/in\\\/jesse-shelley\"],\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/author\\\/realjesseshelley_hkwwlra2\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Simple File Wiping on Linux using shred and dd - Anti-Forensics.com","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/","og_locale":"en_US","og_type":"article","og_title":"Simple File Wiping on Linux using shred and dd - Anti-Forensics.com","og_description":"Use the strings command again, but specify the encoding option strings data01 -e {b,l}. Remember when the \"test\" file was deleted? The rm command was used, not shred. The file name data still resides in the file table and is recoverable because of this.","og_url":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/","og_site_name":"Anti-Forensics.com","article_author":"https:\/\/facebook.com\/stercutis","article_published_time":"2024-03-06T01:18:17+00:00","article_modified_time":"2024-03-07T21:38:11+00:00","og_image":[{"width":1024,"height":1024,"url":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/03\/anti-forensics.com-linux-dd-shred-rm.jpg","type":"image\/jpeg"}],"author":"Max","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Max","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/#article","isPartOf":{"@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/"},"author":{"name":"Max","@id":"https:\/\/anti-forensics.com\/blog\/#\/schema\/person\/ac3dd160cb42b1409a2a55dea58beec2"},"headline":"Simple File Wiping on Linux using shred and dd","datePublished":"2024-03-06T01:18:17+00:00","dateModified":"2024-03-07T21:38:11+00:00","mainEntityOfPage":{"@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/"},"wordCount":735,"commentCount":0,"publisher":{"@id":"https:\/\/anti-forensics.com\/blog\/#organization"},"image":{"@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/#primaryimage"},"thumbnailUrl":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/03\/anti-forensics.com-linux-dd-shred-rm.jpg","keywords":["anti-forensics","dd","linux","rm","shred"],"articleSection":["Anti-Forensics","Digital Forensics"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/","url":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/","name":"Simple File Wiping on Linux using shred and dd - Anti-Forensics.com","isPartOf":{"@id":"https:\/\/anti-forensics.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/#primaryimage"},"image":{"@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/#primaryimage"},"thumbnailUrl":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/03\/anti-forensics.com-linux-dd-shred-rm.jpg","datePublished":"2024-03-06T01:18:17+00:00","dateModified":"2024-03-07T21:38:11+00:00","breadcrumb":{"@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/#primaryimage","url":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/03\/anti-forensics.com-linux-dd-shred-rm.jpg","contentUrl":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/03\/anti-forensics.com-linux-dd-shred-rm.jpg","width":1024,"height":1024},{"@type":"BreadcrumbList","@id":"https:\/\/anti-forensics.com\/blog\/simple-file-wiping-on-linux-using-shred-and-dd\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/anti-forensics.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Simple File Wiping on Linux using shred and dd"}]},{"@type":"WebSite","@id":"https:\/\/anti-forensics.com\/blog\/#website","url":"https:\/\/anti-forensics.com\/blog\/","name":"Anti-Forensics.com","description":"Rendering Digital Investigations Irrelevant","publisher":{"@id":"https:\/\/anti-forensics.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/anti-forensics.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/anti-forensics.com\/blog\/#organization","name":"Anti-Forensics.com","url":"https:\/\/anti-forensics.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/anti-forensics.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/cropped-anti-forensics.com_.jpg","contentUrl":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/cropped-anti-forensics.com_.jpg","width":512,"height":512,"caption":"Anti-Forensics.com"},"image":{"@id":"https:\/\/anti-forensics.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/groups\/14345620\/"]},{"@type":"Person","@id":"https:\/\/anti-forensics.com\/blog\/#\/schema\/person\/ac3dd160cb42b1409a2a55dea58beec2","name":"Max","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g","caption":"Max"},"description":"Anti-forensics involves attempts to hide data, damage the confidentiality, integrity, and availability of data in an effort to make analysis and examination of this data (evidence) difficult or impossible.","sameAs":["https:\/\/anti-forensics.com\/blog","https:\/\/facebook.com\/stercutis","https:\/\/linkedin.com\/in\/jesse-shelley"],"url":"https:\/\/anti-forensics.com\/blog\/author\/realjesseshelley_hkwwlra2\/"}]}},"_links":{"self":[{"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/posts\/341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/comments?post=341"}],"version-history":[{"count":13,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/posts\/341\/revisions"}],"predecessor-version":[{"id":348,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/posts\/341\/revisions\/348"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/media\/356"}],"wp:attachment":[{"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/media?parent=341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/categories?post=341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/tags?post=341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}