HomeToolsAbout

Shred Storage

What is it

Shredding is overwriting data in a file or storage with random bits, making it nearly impossible to recover.

Shred a single file

# shred
sudo shred -vfz path_name

# Shred after finding files
## cd into the directory you want to recursively shred 48 times
find . -type f -print0 | xargs -0 shred -fuzv -n 48

Shred a disk

blkdiscard (Recommended)

# basic
blkdiscard /dev/disk_name

# secure
blkdiscard --secure /dev/disk_name

Because blkdiscard is a host command, it doesn't communicate to the SSD controller directly.

SSDs typically include more flash memory than they advertise to the host OS (spare space to account for bad sectors by design).

The controller knows where all the bits are located, but not the host so there may be 99% guarantee that the data was erased, but not 100%.

Zero-Out a disk

Find name of the drive

fdisk -l # unix
diskutil list # macos
df -h # show all partitions

Unmount the drive

  • If you don't will result in dd: /dev/disk_name: Operation not permitted
sudo diskutil unmountDisk /dev/disk_name

Using dd, copy bits from if to of location

  • bs stands for block size
    • Larger block size speeds up process for dd overall, but plateaus
  • /dev/zero is a special Unix file filled with zeroes
    • /dev/urandom is filled with random numbers (slower)
  • disk_name is obtained from diskutil list

dd is disk/data duplicator/destroyer in Unix-like systems

Keep in mind, this process can take hours if disk is large

  • On Macbook with M1 processor, starts with 373086326 bytes/sec
  • About 373MB/second
    • 3000 seconds per 1TB
    • 2TB = 6000 seconds = 100 minutes = 1.66 hrs (estimate)
  • 2TB Test, Actual
    • 2000398942208 bytes transferred in 5508.083470 secs (363175132 bytes/sec)
sudo dd if=/dev/zero of=/dev/disk_name bs=1M
sudo dd if=/dev/urandom of=/dev/disk_name bs=1M

Tracing

View progress of dd process

  • send signal to the process to print to its stderr stream
sudo kill -INFO $(pgrep ^dd$)

GNU coreutils >=8.24, add status=progress

sudo dd if=/dev/zero of=/dev/disk_name bs=1M status=progress

Alternatives

openssl enc -aes-128-ctr -pass file:/dev/random 2>/dev/null | tail -c+17
AboutContact