The go-to command for deleting or removing files in Linux and other UNIX-like operating systems is the rm command, and experienced users who know how dangerous that command can be usually call it with the -i option, just to be sure they don’t delete something by error.

Though it deletes a file, the rm command does not actually remove the files contents from the file system. It merely marks the occupied space as available, so given enough resources and expertise, a deleted file can be recovered. That point is emphasized in the man page of the rm command:

Note that if you use rm to remove a file, it might be possible to recover some of its contents, given sufficient expertise and/or time. For greater assurance that the contents are truly unrecoverable, consider using shred.

I did not know before reading that bit that there is a command named shred, which when called to remove a file does so in a manner that makes it impossible or nearly impossible to recover. Shred manages that feat by overwriting the target file several times. By default shred overwrites a target file 3 times, but that number can be increased by calling it with the -n flag.

Also important to note that while shred will overwrite a file, by default, it will not revome the file from the system. For that to happen, you need to call the command with the -u option.

Depending on your operating system’s filesystem, though, shred might not work as intended. Its man page notes that shred might not work on:

log-structured or journaled file systems, such as those supplied with AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)

Ext3 is the deceased sibling of Ext4, the default filesystem on most Linux distributions, including the one I’m writing this article on – Linux Mint. With particular reference to Ext3, the man page states that shred might not work if Ext3 is operating in data=journal mode. In that mode, Ext3 “journals file data in addition to just metadata”. But in data=ordered and data=writeback modes, shred should work just fine.

Since Ext3 is long dead and Ext4 has taken its place, and they both bear the same DNA, we can assume that the gist of the previous paragraph also applies to Ext4. So what is the default mode of operation for Ext4 or what is the mode of operation of Ext4 on your Linux distribution? You can find that bit of info with the following command. The expected output is also given:

 

# > denote command's output

dmesg | rg -i ext4

> [xxx] EXT4-fs (dm-1): mounted filesystem with ordered data mode. Opts: (null)
> [xxx] EXT4-fs (dm-1): re-mounted. Opts: errors=remount-ro
> [xxx] EXT4-fs (sda2): mounted filesystem with ordered data mode. Opts: (null)

 

If the output of that command on your system matches that, then you’re in safe hands – with shred. So the next time you really want to get rid of a file and its contents on a Linux distribution that uses the Ext4 filesystem, consider shred-ing it instead of rm-ing it. And if you’re paranoid and want to hide the fact that you shred-ed the file, you can call it with the -z option, so that it overwrites it a final time with zeros.