dawsbot / skrub

Irreversible file deletion on every OS

Irreversible file deletion on every operating system
* Will only work securely on file systems that overwrite blocks in place *

In contrast to rm, which leaves file contents unallocated in memory, skrub first floods file(s) with garbage data and then removes them forever.

The current method is low fidelity and "will prevent the data from being retrieved simply by reading using standard system functions". Read more in the FAQ below or on Wikipedia here.

Works on OS X, Linux, and Windows.

Looking for the command-line version?

Install

npm install --save skrub

Or try the command-line version

npm install --global skrub

Usage

const skrub = require('skrub');

skrub(['*', '!important*']).then(paths => {
    console.log('Skrubbed files and folders:\n', paths.join('\n'));
});

You can use glob patterns.

API

skrub(patterns, [options])

Returns a promise for an array of skrubbed paths.

patterns

Type: string, array

See supported minimatch patterns.

• Pattern examples with expected matches
• Quick globbing pattern overview

options

Type: object

dryRun

Type: boolean
Default: false

See what would be skrubbed without actually deleting anything.

skrub(['tmp/*.js'], {dryRun: true}).then(paths => {
  console.log('Files and folders that would be skrubbed:\n', paths.join('\n'));
});

In additon to these two options, all node-glob options are also available.

iterations

Type: number(must be >= 0)
Default: 1

Zero-fill the specified file multiple times.

skrub(['tmp/*.js'], {iterations: 7}).then(paths => {
  console.log('Files and folders that would be skrubbed:\n', paths.join('\n'));
});

skrub.floodFile(filePath, iterations)

Returns a promise for the flooded filePath. Replaces the contents of file at filePath with the same amount of bytes zero-filled.

filePath

Type: string

iterations

Type: number(must be >= 0)
Default: 1

Zero-fill the specified file multiple times.

FAQ

Unreliable file systems

skrub and other overwriting-based methods may not be effective on your file system, since the disk may not actually write where you think it's writing. Here is a list of systems which are known not to cooperate with the current file overwriting method. Why don't these work?

• copy-on-write systems like btrfs
• ssd's at large
• reiserfs
• COW

In the above scenarios, skrub is just a friendly wrapper around rm.

How secure is this?

At a minimum, this will prevent the data from being retrieved simply by reading from the media again using standard system functions.

But I can do the same thing with rm

Not really. The rm command simply frees the file-pointer in your operating system. This allows the file contents to be written over at a later date. This means that during the time before that memory location is needed (which it may never), your data is still at rest on your system.

rm ships with a -P flag which first does file overwrites with blank data. Although the end result is similar, this does not support negation in globbing and is not cross-platform.

But I can do the same thing with shred

Not the case. The shred command is a Linux only distribution while skrub is cross-platform. skrub also supports negation within file globbing. shred does not have a friendly node.js module wrapper around it either.

Benchmarking

TL;DR: Running more iterations than one is hardly slower.

skrub(tempFile, {iterations: 1}) x 57,512 ops/sec ±2.60% (69 runs sampled)
skrub(tempFile, {iterations: 7}) x 54,338 ops/sec ±2.59% (82 runs sampled)
skrub(tempFile, {iterations: 36}) x 54,631 ops/sec ±2.95% (79 runs sampled)
Fastest is skrub(tempFile, {iterations: 1})

Try it yourself:

npm run benchmark

Related

• skrub-cli
• file-wipe
• del
• trash

License

MIT © Dawson Botsford

skrub's Issues

Support directory removal

Currently, you're met with the following error (this is a skrub-cli call, but it makes no difference since it's an issue in this api)

$ skrub <directory>
events.js:141
      throw er; // Unhandled 'error' event
      ^

Error: EISDIR: illegal operation on a directory, open '/Users/dawsonbotsford/<directory>'
    at Error (native)

(directory name redacted)

add usage and docs for `flood` method

• Document method
• Include usage instructions

Comparison with shred?

How is this tool different from shred -z --remove='unlink'?

Perhaps it will be useful to include a comparison with shred in the README.

unreliable on operating systems with a write cache, cannot work on COW filesystems

skrub appears to write to the file in streaming mode, without any attempt to synchronize data (fsync()). This means that any operating system with a worthwhile implementation of write caching is likely to write the zeroes into its write cache, make a note to write the "dirty" data from the write-cache back to disk at a later time, and report success. skrub responds to this apparent success by deleting the file, at which point it is valid for the operating system to discard the dirty data from the write cache without it ever reaching the disk. Instead of fixing this, I would strongly recommend using an existing OS-specific tool such as shred or wipe which gets the OS-specific details right (to the extent that this is even possible on modern hardware and filesystems).

skrub and analogous tools such as shred and wipe also cannot possibly work on copy-on-write filesystems such as btrfs, even on hardware where traditional "secure deletion" would have worked, due to the way these filesystems are structured.

A better approach to data confidentiality is to use whole-disk encryption such as Linux LUKS or Windows BitLocker, and/or avoid having secrets ever reach the disk at all.

Writing zeroes is not enough

There is a tremendous amount of prior work on this topic. Before advertising to people that their deletions are secure, there are a number of factors to consider, such as whether or not it's an encrypted or compressed filesystem, whether it's going to SSDs (whose firmware just relinks 4K page chunks in the flash) or platter hard drives (where trace magnetism can be used to recover even zeroed-out bytes).

Look for instance at https://en.wikipedia.org/wiki/Gutmann_method, and existing tools like srm.