# &app; Manual V&manrevision;

## Overview

&app; allows you to wipe files or available diskspace from Nautilus.

Usually when you delete a file, even when bypassing the trash, it is not accessible anymore, but its content still exists on the medium that contained it until a new file is written over it. Consequently, it can be quite easy to recover it.

&app; enables you to wipe files and available disk space from Nautilus using the secure-delete program written by van Hauser / THC

[1]. Secure-delete, van Hauser / THC vh@thc.org, 1997-2003 `http://www.thc.org`

.

## An introduction to data deletion

### Deletion doesn't affect data

When you delete a file, even when bypassing or emptying the trash, you only tell your computer that you don't care anymore about the file. The file's entry is removed from the list of existing files but the content of the file remains on the storage medium. The data will remain there until the operating system reuses the space for new data.

It could take weeks, months or years before this space get used for new data, actually overwriting the content of the deleted file. Until then, it is possible to recover the data by reading directly on the storage medium. That's a quite simple operation, automated by numerous software.

### An answer: overwriting data several times

If you want to make the content of a file really hard to recover, you have to overwrite it with other data. But that's not enough. On a magnetic hard disk, it is known

[2]. Peter Gutmann: Secure Deletion of Data from Magnetic and Solid-State Memory, 6th Usenix Security Symposium, 1996 `http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html`

that the content can still be recovered by doing magnetic analysis of the hard disk surface. To address this issue, it is possible to overwrite the content to be deleted several times. That process is called "wiping".

If some sensible files have been already deleted without paying attention to this issue, some of their data probably remains on the storage medium. It is thus also useful to wipe all the available free space of a storage medium.

### Limitations

This section is quite technical. In a nutshell, there's a lot of limitations, so using this tool without setting up a complete security policy will probably be useless.

- Temporary files and disks: lots of programs writes temporary and backup files. This means that the sensitive data you want do delete probably exists in an other form somewhere on your computer;

- swap space: most operating systems could save data they are working on on a part of the hard disk called swap space. Your sensitive data could exist there;

- storage media features: modern storage media often reorganize their content, e.g. to spread the writings over the medium or to hide defective places to the operating system. Consequently, you can't be sure that the actual place occupied by your sensitive data was wiped;

- journalized file systems: modern file systems log modifications of the files to ease recovering after a crash. This could make wiping inefficient. The same kind of problem exists with redundant file systems (e.g. RAID), file systems that make snapshots or that caches data (e.g. NFS). However, only the names of the files are logged if you use the default parameters of the standard Linux file system (ext3/ext4);

- old algorithms: the wipe algorithms are old, and they are not guaranteed to work as expected on new storage media.

### The wipe algorithm

nautilus-wipe enables you to wipe files and free disk space from Nautilus using the secure-delete program written by van Hauser / THC

Secure-delete, van Hauser / THC vh@thc.org, 1997-2003 `http://www.thc.org`

> secure-delete documentation

> The deletion process is as follows:

> 1. the default overwriting procedure does a 2 times overwriting. After each pass, the disk cache is flushed.

> 2. truncating the file, so that an attacker don't know which disk blocks belonged to the file.

> 3. renaming of the file, so that an attacker can't draw any conclusion from the filename on the contents of the deleted file.

> 4. finally deleting the file (unlink).

## Using &app;

### Launching &app;

#### Wiping file(s) or directory(es)

Select the file(s) you want to wipe, and right-click on them. If &app; is able to wipe them, there will be a Wipe entry in the context menu.

#### Wiping available diskspace on storage media

Select a file or a directory which is on the partition on which you want to wipe the available diskspace, and right-click on it. If &app; is able to wipe it, there will be a Wipe available diskspace entry in the context menu.

### The confirmation dialog

Once you click a menu item, a confirmation dialog will appear, where you can confirm or abort the wipe, and choose options (see nautilus-wipe-config).

### The progress dialog

If you confirm the wipe, a dialog will appear to let you see the progression of the deletion. For big files or partitions with a lot of available diskspace, wiping can take hours.

It's possible, but discouraged, to cancel the wipe process. This would kill the underlaying secure-delete program and could lead to strange things like files partially overwritten but not deleted or big junk files.

When the wipe is finished, a dialog should inform you of the success of the deletion.

## Configuring &app;

In the confirmation dialog, you can click on the arrow left to the Options word to display options. To understand these options, you must have a good overview of the wipe process. If it's not already the case, please read nautilus-wipe-data-deletion-intro.

### Number of passes

You can configure the number of times that the data to be wiped is overwritten by new data.

### Number of passes

38

- Overwriting the data 38 times was the algorithm advised by Gutmann. It was designed to prevent data recovery through magnetic analysis of the hard drive surface, but relied on discontinued hardware technologies. It is thus not advised anymore.

2

- Two passes are written: one mode with 0xff and a final mode random values. This seems to be enough on modern hard drives and is thus the default behaviour.

1

- Only one random pass is written. It should prevent software-only data recovery performed by analyzing raw data stored on the storage medium. However it is probably not sufficient against magnetic analysis of the hard drive surface.

### Fast and insecure mode (no /dev/urandom, no synchronize mode)

Fastens the wipe at the expense of security:

- use a more predictable but faster pseudo-random number generator;

- do not ensure that overwriting data is actually written on the storage medium.

### Last pass with zeros instead of random data

Use zeros for the last overwrite, which is the data that will be actually easy to read. The default is to use pseudo random data.

## About &app;

&app; was written by The Nautilus Wipe Team

This program is distributed under the terms of the GNU General Public license as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. A copy of this license can be found at this link, or in the file COPYING included with the source code of this program.