How to securely delete files (and when not to bother)

Deleting does not delete

Removing a file removes its directory entry. The contents stay on the disk, unreferenced, until something happens to write over them. That is why file recovery works at all, and it is why “I deleted it” is not an answer to “is it gone”.

Emptying the recycle bin or the trash does not change this. It removes the last directory entry, and that is all.

On a hard disk, overwriting works

If the drive has spinning platters, the model is simple: the data is at a physical location, you write different bytes to that location, the old bytes are gone. One pass of random data is enough. The multi-pass patterns you may have heard of come from a 1996 paper about drive densities that stopped existing decades ago, and their author has said as much since. Extra passes cost time and buy nothing.

What matters more than the number of passes is that each one actually reached the disk rather than sitting in a write cache, and that the file was not moved by the filesystem partway through.

On an SSD, overwriting mostly does not

This is the part that catches people out, and it is worth being precise about.

An SSD does not let you write to a physical location. It presents an abstraction — a list of numbered blocks — and a controller inside the drive decides where those actually land, moving data around to spread the wear. Write over a file and the controller will very likely write your new bytes to a fresh page and mark the old one for later reuse. The original contents are still on the flash, unreachable through any normal interface, until the drive gets round to erasing that block.

Every SSD also has more physical flash than it admits to, kept in reserve. Data can sit in that reserve indefinitely.

So on an SSD, overwriting a single file gives you a strong feeling and a weak guarantee.

What to do instead

Encrypt the whole disk, before you have anything to hide. BitLocker on Windows, FileVault on macOS. Then a file’s contents are ciphertext everywhere they exist, including in the parts of the SSD you cannot address, and destroying the encryption key destroys all of them at once. This is the real answer for almost everybody, and it is a thing to do now rather than at the point you need it.

To wipe a whole SSD, use the drive’s own erase. ATA Secure Erase, or the manufacturer’s utility, which tells the controller to discard the keys or reset every block. That reaches the reserve; writing zeroes over the visible blocks does not.

To wipe a whole hard disk, overwrite it once, end to end. Then verify by reading it back.

Physical destruction is the only option that needs no argument, and for a failed drive that will not respond to an erase command it is the only one available.

The traces you forgot about

Deleting the file is often the smaller half of the problem. The same information tends to exist in several other places:

• Thumbnail and preview caches, which keep a picture of a document long after the document is gone.
• Search indexes, which keep the text.
• Application recent-file lists, autosave and crash-recovery folders.
• Browser history, cache, cookies and download lists — and the browser keeps history somewhere non-obvious, in a database file rather than anything called “history”.
• Cloud sync folders, which have already sent a copy somewhere else, and which usually keep their own version history for a month.

If the point is that nobody should be able to tell what you were working on, the file itself is not sufficient.

The programs for this

• PrivacySweep overwrites files with random data, fsyncs each round, then removes them, and writes a report of what it destroyed. It is a dry run that only lists files unless you pass --apply. There is no quarantine mode and there is no undo — that is the point of it, and it is the one program here where “moved, not deleted” does not apply.
• EraseProof does the same thing on a schedule, against a written policy — a directory, a pattern, an age — and appends to a ledger you can show somebody. scan is read-only and previews what currently matches.
• CleanVault goes after the traces rather than the files: it carries a catalogue of where browsers and applications keep history, caches and recent-file lists on each operating system, reports what exists, and quarantines matches rather than deleting them.
• TraceGuard checks a fleet of machines against a written policy and reports which ones fall short.

Free while we are in preview, one file each, Windows and Mac.

Before you erase anything

Check you do not need it. Secure erasure is the one operation on this site with no undo, and the most common thing it destroys is something the person actually wanted.