Question

I recently accidentally called “rm -rf *” on a directory an deleted some files that I needed. However, I was able to recover most of them using photorec. Apparently, “deleting” a file just removes references to said file and is not truly deleted until it is overwritten by something else.

So if I wanted to remove the file completely, couldn’t I just execute

mv myfile.txt /temp/myfile.txt

(or move to external storage)

Answer 1

No. that won’t help either.

A move when going between file systems is really still just a “copy + rm” internally. The original storage location of the file on the “source” media is still there, just marked as available. A moving WITHIN a file system doesn’t touch the file bytes at all, it just updates the bookkeeping to say “file X is now in location Y”.

To truly wipe a file, you must overwriteall of its bytes. And yet again, technology gets in the way of that – if you’re using a solid state storage medium, there is a VERY high chance that writing ‘garbage’ to the file won’t touch the actual transistors the file’s stored in, but actually get written somewhere completely different.

For magnetic media, repeated overwriting with alternating 0x00, 0xFF, and random bytes will eventually totally nuke the file. For SSD/flash systems, it either has to offer a “secure erase” option, or you have to smash the chips into dust. For optical media, it’s even more complicated. -r media cannot be erased, only destroyed. for -rw, I don’t know how many repeated-write cycles are required to truly erase the bits.