How to Permanently Delete Files Beyond Recovery on Windows, macOS, and Linux

In the modern world, privacy and data security are major concerns. Every time you delete a file, there’s a chance it isn’t actually gone from your computer. Despite being sent to the Recycle Bin or Trash and emptied, files remain stored on your disk until the space is overwritten by new data. Even after deletion, forensic tools can often recover these files. As a result, if you need to ensure that sensitive data is permanently deleted and cannot be recovered, secure deletion methods are required. This article discusses how to delete files securely on Windows, macOS, and Linux, using a range of tools and techniques to guarantee that deleted files cannot be retrieved.

The Problem with Regular File Deletion

When you delete a file, the operating system marks the space it occupied as available for new data but does not actually erase the file's contents. Depending on the file system (NTFS, ext4, APFS, etc.), the operating system may only remove pointers to the file in the directory structure, but the file's data can remain on the disk for some time until it is overwritten.

Data Recovery and Forensics

Recovery tools like Recuva, PhotoRec, TestDisk, and even advanced forensic recovery methods can retrieve deleted files, even if they have been emptied from the Recycle Bin or Trash. These tools exploit the fact that the data is still physically stored on the hard drive and can be recovered until the space is overwritten by new files.

Forensic specialists can use sophisticated techniques to rebuild the original data from residual traces. Therefore, the assumption that a deleted file is gone is fundamentally flawed unless a secure deletion method is used.

What Is Secure Deletion?

Secure deletion refers to the process of overwriting the data multiple times, using random data or predefined patterns, until the original data is completely destroyed and cannot be reconstructed. There are various standards and methods, such as:

• DoD 5220.22-M: This method involves overwriting a file three times with random data and zeros.
• Gutmann Method: This method overwrites the file 35 times with a range of data patterns. It's considered highly secure, but it's often unnecessary for most users.

When files are securely deleted, it’s not just the directory pointers that are erased but also the underlying data itself, rendering it irrecoverable.

Permanently Deleting Files on Windows

Windows offers built-in tools as well as third-party software that can securely delete files. In this section, we will focus on tools such as SDelete and the cipher command, providing both their installation and usage steps.

1. Using SDelete (Sysinternals Tool)

Microsoft’s SDelete (Secure Delete) is a popular utility for securely deleting files, directories, or free space. SDelete is developed by Sysinternals, a Microsoft-owned company that specializes in powerful system utilities.

Installing SDelete:

• Download SDelete from the Sysinternals website:

SDelete on Microsoft Sysinternals

• Extract the ZIP file to a directory (e.g., C:\Tools).
• Optionally, add this folder to your system’s PATH to make it easier to access via the command line.

For installation demo watch the video

Using SDelete:

1. Open Command Prompt as an administrator. (Right-click on the Start button, then select “Command Prompt (Admin)”).

2. Navigate to the folder where the file you want to delete is stored.

3. Use the following command to securely delete the file:

sdelete -p 3 -s file_name

Explanation:

-p 3: Overwrites the file three times. You can adjust the number to a higher value (e.g., 7 for more security).

-s: Deletes the file securely.

file_name: Replace this with the name of the file you wish to delete.

Example:

sdelete -p 5 -s password.pdf

This will overwrite the file secret_document.pdf five times with random data, ensuring that it cannot be recovered.

Securely Deleting Free Space

SDelete can also be used to overwrite free space, effectively preventing any deleted files from being recovered:

sdelete -z C:

This command will overwrite all unused space on the C: drive with zeros, ensuring no residual data is left behind from deleted files.

For demonstration watch the video

2. Using the Cipher Command

The cipher command is a built-in tool in Windows that can overwrite free space but does not specifically target individual files for deletion. However, it can still help ensure that deleted files are not recoverable.

Using Cipher for Free Space:

• Delete the file normally by either sending it to the Recycle Bin or using the del command:

del file_name

• Use the following cipher command to overwrite the free space:

cipher /w:C:\Path\To\Folder

Example:

cipher /w:C:\Users\Documents

This will overwrite all free space in the specified folder, making it impossible to recover any deleted files that were previously stored there.

Limitations: While cipher secures free space, it does not directly target specific files. It is best used in combination with manual deletion.

Permanently Deleting Files on macOS

macOS offers several methods for securely deleting files, though older versions included the srm command (secure remove), which has been removed in more recent macOS versions like macOS Ventura. For newer versions of macOS, you will need third-party tools like shred.

1. Using the srm Command (Older Versions)

The srm command was previously included in macOS to securely remove files by overwriting them multiple times.

Using srm:

• Open the Terminal application (found in Applications > Utilities).
• Navigate to the directory containing the file you want to delete.
• Use the following command:

srm -vz file_name

Explanation:

-v: Enables verbose mode, displaying progress.

-z: Adds a final overwrite with zeros after performing the overwrites.

Example:

srm -vz passwords.pdf

This will securely delete the file confidential_info.pdf and make it unrecoverable.

Limitations: srm is unavailable in macOS versions like Ventura. Use third-party tools for secure deletion in newer versions.

2. Using the shred Command (Modern macOS)

Since macOS removed the srm tool, a great alternative is using shred from the GNU core utilities, which can be installed via Homebrew.

Installing shred via Homebrew:

• If you don’t have Homebrew installed, install it by running the following command:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

• Once Homebrew is installed, use it to install coreutils, which includes shred:

brew install coreutils

Using shred:

• Navigate to the file you want to delete:

cd /path/to/file

• Run the following command to securely delete the file:

gshred -u -n 3 file_name

Explanation:

-u: Removes the file after overwriting it.

-n 3: Overwrites the file three times with random data.

Example:

gshred -u -n 5 passwords.txt

This will securely overwrite sensitive_data.txt five times with random data and then delete it.

Permanently Deleting Files on Linux

Linux provides several command-line utilities, such as shred and wipe, for secure file deletion. Linux users have a variety of options for both file deletion and free space wiping.

1. Using the shred Command

The shred command is available by default on most Linux distributions and securely overwrites files before deleting them.

If it's not installed on your Linux by default then install it by executing the command given below:

pkg install coreutils

Note:- Coreutils comes with a lot pre-built programs which are given below and shred is one of them.

b2sum base32 base64 basename basenc cat chcon chgrp chmod chown chroot cksum comm cp csplit cut date dd dir dircolors dirname du echo env expand expr factor false fmt fold ginstall groups head id join kill link ln logname ls md5sum mkdir mkfifo mknod mktemp mv nice nl nohup nproc numfmt od paste pathchk pr printenv printf ptx pwd readlink realpath rm rmdir runcon seq sha1sum sha224sum sha256sum sha384sum sha512sum shred shuf sleep sort split stat stdbuf stty sum sync tac tail tee test timeout touch tr true truncate tsort tty uname unexpand uniq unlink vdir wc whoami yes

Using shred:

• Open the Terminal.
• Navigate to the directory containing the file:

cd /path/to/file

• Use the following command to securely delete the file.

shred -u -n 5 file_name

Explanation:

-u: Deletes the file after overwriting it.

-n 5: Overwrites the file five times.

Example:

shred -u -n 7 confidential_document.pdf

This command will overwrite confidential_document.pdf seven times with random data before securely deleting it.

More Common Options You Can Try

-n <number>: Specifies the number of overwrite passes. Default is 3.

-z: Overwrites the file with zeros in the final pass to disguise shredding.

-u: Deletes the file after shredding.

-v: Enables verbose mode to display the shredding progress.

--force: Forces the operation on write-protected files.

--remove: Similar to -u, removes the file after shredding.

2. Using the wipe Command

The wipe command is another tool available for secure file deletion and free space wiping.

Installing wipe:

Install wipe using your package manager:

sudo apt install wipe   # For Ubuntu/Debian
sudo yum install wipe   # For RedHat/CentOS

Using wipe:

Run the following command to securely delete a file:

wipe -f file_name

Example:

wipe -f password.zip

This will securely delete sensitive_data.zip by overwriting it multiple times, making recovery impossible.

Wiping Free Space

To wipe free space on your system (which might contain remnants of deleted files), you can use the following command:

wipe -r /mount/point

Replace /mount/point with the appropriate mount point of the drive or partition whose free space you want to wipe.

More Common Options You Can Try

-r: Recursively wipes directories and their contents.

-f: Forces wiping on write-protected files.

-i: Prompts before each file is wiped.

-q: Quiet mode, suppresses output.

-v: Verbose mode, displays detailed progress.

-Q <number>: Specifies the number of overwrite passes (default is 4).

-R: Removes the file/directory after wiping.

Key Differences Between wipe and shred

File System Awareness:
wipe handles file systems better than shred, particularly for directories.

File Deletion:
wipe can remove files and directories after wiping (-R), while shred requires -u.

SSD Considerations for Secure Deletion

With the rise of Solid State Drives (SSDs), secure deletion methods have become more complicated. SSDs use a technology called wear leveling, which spreads data across the drive to prevent certain memory cells from wearing out too quickly. This makes traditional secure deletion methods less effective, as overwriting files multiple times may not always overwrite the data due to the way SSDs handle storage.

Best Practices for Secure SSD Deletion

1. Use Full-Disk Encryption (FDE): The best approach to ensuring that deleted data is irrecoverable on an SSD is to use full-disk encryption (FDE) before the data is written. Once encrypted, formatting or erasing the SSD makes the data unrecoverable because the encryption key is lost.

• BitLocker on Windows
• FileVault on macOS

LUKS on Linux

2. Using SSD Manufacturer’s Secure Erase Tools: Many SSD manufacturers provide proprietary tools designed to securely erase data on their drives by instructing the controller to wipe all stored data. These tools typically perform an internal erase on the drive that ensures that the data is not recoverable.

For example, Samsung Magician or SanDisk SSD Toolkit offers secure erase features for supported SSDs.

3. Physical Destruction: If you have highly sensitive data that must be destroyed beyond recovery and the device is no longer needed, physically destroying the SSD is the most effective option. This could involve shredding the drive, crushing it, or using a degausser to disrupt the magnetic field, although SSDs do not store data magnetically.

Data Destruction vs. Data Deletion

It’s essential to differentiate between data deletion and data destruction.

• Data Deletion refers to the logical process of removing data from a system, making it inaccessible to users. Secure deletion methods, such as those discussed above, ensure that files are deleted in such a way that they cannot be recovered by normal or forensic recovery tools.
• Data Destruction, however, involves physically destroying the media that holds the data. This is used when the data is so sensitive that there’s no acceptable risk of recovery.
• For example, simply deleting a file may not be enough if the drive itself is to be discarded. In such cases, physical destruction of the drive is recommended to guarantee that data cannot be retrieved by any means.

Additional Tools for Secure Deletion

While we've covered the primary tools available on Windows, macOS, and Linux, there are additional third-party tools that can offer more features or greater ease of use.

1. Eraser (Windows)

Eraser is a free, open-source program for Windows that provides advanced secure deletion methods for files, folders, and free space. It supports multiple overwriting schemes, including DoD 5220.22-M and Gutmann.

Installation and Use:

• Download Eraser from the official site.
• Install and launch the program.
• Select files or folders to delete securely by right-clicking them and choosing “Eraser” from the context menu.
• Eraser will overwrite the files multiple times based on the chosen algorithm, ensuring that they are unrecoverable.

2. CCleaner (Windows, macOS, and Linux)

CCleaner is a widely used tool that not only helps clean your system by removing temporary files but also provides options for securely deleting files and wiping free space. While it’s more known for general system maintenance, its file-shredding feature can be useful for securely erasing data.

Steps:

• Download and install CCleaner.
• Open the program and navigate to the "Tools" section.
• Select the "Drive Wiper" tab to wipe free space or securely delete files from a specific location.
• Choose the number of passes and the algorithm, then click "Wipe."

How to Ensure Deletion Success

To ensure the permanent deletion of a file and avoid recovery:

• Multiple Passes: The more passes you make (e.g., 3, 5, or 7 passes), the harder it is for recovery tools to reconstruct the original data.
• Random Overwriting: Using random data for overwriting ensures that the old data is not reconstructible, unlike zero-filling which might still leave traces.
• Wipe Free Space Regularly: Free space on your drive is often where deleted files reside until overwritten. By wiping free space regularly, you prevent any old files from being recovered.
• Use Strong Encryption: If you're storing sensitive data, using strong encryption tools like BitLocker (Windows), FileVault (macOS), or LUKS (Linux) ensures that even if someone gets access to your drive, the data remains secure.

Conclusion

Secure deletion is an essential part of maintaining privacy and protecting sensitive data. In a world where data breaches, identity theft, and privacy concerns are growing threats, simply pressing "Delete" is no longer sufficient. Whether you’re using SDelete on Windows, srm or shred on macOS, or wipe and shred on Linux, each tool provides a way to make sure that your deleted files are gone for good. For SSDs, encryption and manufacturer tools are your best bet, and physical destruction remains the ultimate safeguard.

By using these secure deletion methods, you can ensure that your files are irrecoverable, safeguarding your personal and professional data from potential misuse.