Mike McCarty wrote:
Robert Nichols wrote:
Mike McCarty wrote:
One issue is that if I overwrite the file, the location
which contains the original data is *not* the place the overwrite
is done to.
The 'shred' program overwrites the file in a manner that does not
reallocate the space. You can also do that with 'dd' if you use
[snip]
Hmm. The man page for shred contradicts what you say.
QUOTE MODE ON
CAUTION: Note that shred relies on a very important assumption: that
the filesystem overwrites data in place. This is the traditional way
to do things, but many modern filesystem designs do not satisfy this
assumption. The following are examples of filesystems on which shred
is not effective:
* log-structured or journaled filesystems, such as those supplied with
AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)
QUOTE MODE OFF
The context of this discussion is ext3.
Mike
It's easy enough to test. Create a file on an ext3 file system.
Unmount the file system, run 'debugfs' and use its "stat" command
to see the list of block numbers for that file. Mount the file
system again and run 'shred' to overwrite the file without deleting
it. Unmount the file system and use 'debugfs' again to examine the
list of block numbers. Observe that they are the same. Then
repeat the experiment but use 'dd' with the "conv=notrunc" option
instead of 'shred'.
--
Bob Nichols Yes, "NOSPAM" is really part of my email address.
