This is the README file for wipefreespace, a program for secure wiping
of free space on file systems.
Wipefreespace wipes the following things (when supported by the backing
library):
- free space (space in unused blocks/clusters)
- free space in partially used blocks (also called the "slack space")
- deleted files' names and other data that can be used to undelete a file
(like the journal)
Wipefreespace does NOT decrease the amount of available free space when
working.
NOTE: it is best to use this program on un-mounted file systems, what
makes sure the journal is committed.
NOTE: if a block is damaged, it is only wiped until the first error. There is
no guarantee that it will be fully wiped.
================================================================
Requirements for compiling the full version:
- a working C compiler. XFS, ReiserFS, Reiser4 and NTFS support require the
'long long' data type. NTFS support may require the gcc compiler.
C++ compilers won't work due to variable casts.
- development package for the C library (like glibc-devel and glibc-headers)
- the 'make' program
- Ext2/3/4: the development package for the ext2 file system library, libext2fs
(usually included in something like e2fsprogs-devel). If you don't have
anything like this installed or available (check twice), then go to
http://e2fsprogs.sf.net/
Then compile and install that package. Ext4 support requires new versions,
like 1.41.
- NTFS: the development package for the NTFS file system library,
ntfs3g-ntfsprogs. If you don't have anything like this installed or
available (check twice), then go to
http://www.tuxera.com/community/ntfs-3g-download/
Then compile and install that package. You can also use libntfs (usually
included in something like ntfsprogs-devel).
- XFS: xfsprogs installed and in your PATH variable, if you want XFS support.
Get these at http://oss.sgi.com/projects/xfs/. The following utilities
should be available: xfs_db, xfs_freeze, xfs_unfreeze. The xfs_db program
should support the following command-line options: "-i", "-c" and the
following interactive mode commands: "quit", "freesp -d", "blockget -n",
"ncheck", "sb 0", "print". Version 2.7.11 is enough, earlier versions will
probably also work.
- ReiserFSv3: development package for reiserfsprogs (header files - *.h - and
compiled static libraries - *.a - from the package). ReiserFS requires either
the fork() function (unistd.h) and one of the waitpid(), wait() functions
(sys/wait.h), the mntent.h header file (with at least one of its functions
- getmntent() or getmntent_r()).
If you're having trouble compiling, try to apply the patch first:
patch -F10 -p1 < /path/to/wipefreespace-XX/patches/reiser-3.6.XX-compile-fix.diff
See below for other patches that may be necessary.
- Reiser4: development package for reiser4progs, libuuid (e2fsprogs or
e2fsprogs-libs), libaal and the mntent.h header file. Go to
http://www.kernel.org/pub/linux/utils/fs/reiser4/
and
http://e2fsprogs.sf.net/
to get the libraries. After installing, libmisc.a needs to be copied
in the same place as libreiser4.a, but under a different name,
libreiser4misc.a:
cp reiser4progs-XX/libmisc/.libs/libmisc.a /dst/path/libreiser4misc.a
Libmisc.a is in reiser4progs, of course. Nobody thought it would be
needed, but libreiser4.a is useless without it.
- FAT12/16/32: tffs-lib, the Tiny FAT FS library. Go to
https://github.com/likema/tffs-lib
to get the library (former address: http://code.google.com/p/tffs-lib/).
To make WipeFreeSpace work faster, apply the patch that removes synchronising
the filesystem from TFFS (WipeFreeSpace does its own synchronising):
patch -F10 -p0 < /path/to/wipefreespace-XX/patches/tffs-speed.diff
If you experience crashes (especially on x64), you may try to apply three
more patches:
patch -F10 -p0 < /path/to/wipefreespace-XX/patches/tffs-free-fix.diff
patch -F10 -p0 < /path/to/wipefreespace-XX/patches/tffs-overflow-fix.diff
patch -F10 -p0 < /path/to/wipefreespace-XX/patches/tffs-fat-eof-fix.diff
patch -F10 -p0 < /path/to/wipefreespace-XX/patches/tffs-dir-fix.diff
After applying any patch, you need to recompile and install the library -
libtffs.a - and ALL its header files - *.h - (including the private ones,
from the src directory).
- MinixFS: "mfstool", the MinixFS tool. Go to
http://mfstool.sourceforge.net/
to get this program. Before compiling, perform:
sed -i 's/opt_squash/0/g' `ls *.c | egrep -v main`
then compile the program (./configure && make), then perform
ar surf libminixfs.a `ls *.o | egrep -v main`
Then copy the files libminixfs.a, minix_fs.h and protos.h to a directory
where the C compiler can find them (or put the correct -I and -L options
in the compiler flags). You can use the provided patches to do this
instead of the sed command:
patch -F10 -p1 < /path/to/wipefreespace-XX/patches/mfstool-0.5.diff
- JFS: jfsutils and libuuid (the <uuid/uuid.h> header file). Go to
http://jfs.sourceforge.net/
to get jfsutils. Libuuid can be a part of "util-linux-ng", which can be
found on the kernel site:
ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng/
or as a part of e2fsprogs available at
http://e2fsprogs.sf.net/
Compile jfsutils, then copy all the jfs_*.h header files from the
"include" subdirectory and the libfs.a file to a directory where the
C compiler can find them (or put the correct -I and -L options in the
compiler flags).
If you're having trouble compiling, try to apply the patch first:
patch -F10 -p1 < /path/to/wipefreespace-XX/patches/jfsutils-1.1.11-compile-fix.diff
- HFS+: the "hfsplus" package. Go to
https://launchpad.net/ubuntu/+archive/primary/+files/hfsplus_1.0.4.orig.tar.gz
to get it. Before compiling, apply the patch:
patch -F10 -p1 < /path/to/wipefreespace-XX/patches/hfsplus-1.0.4.diff
After compiling, install all the libraries - *.a - and ALL the header
files - *.h - from the libhfsp/src/ directory where the C compiler can
find them (or put the correct -I and -L options in the compiler flags).
- OCFS: the "ocfs2-tools" series 1.6.x package (other versions also work, but
disable wiping undelete data in such case). Go to
http://oss.oracle.com/projects/ocfs2-tools/
to get it. Then compile and install that package.
If you're having trouble compiling, try to apply the patch first:
patch -F10 -p1 < /path/to/wipefreespace-XX/patches/ocfs2-tools-1.6.4-compile-fix.diff
WARNING: Some filesystem backends may not be compatible. Read the full
README file in the documentation.
Type
./configure
to configure the program for your system.
Type
make
to compile the program.
Type
make install
to install the program (NOT recommended) or read below on how to make an
RPM package (recommended).
Type 'info wipefreespace' to get help.
Syntax:
wipefreespace [options] /dev/XY [...]
Command line options:
--all-zeros Use only zeros for wiping
--background Continue work in the background, if possible. This
disables verbose mode.
-b|--superblock <off> Superblock offset on the given filesystems
-B|--blocksize <size> Block size on the given filesystems
-f|--force Wipe even if the file system has errors
-h|--help Print help
--last-zero Perform additional wiping with zeros
-l|--license|--licence Print license information
--method <name> Use the given method for wiping (read below)
-n|--iterations NNN Number of passes (greater than 0)
--nopart Do NOT wipe free space in partially used blocks
--nounrm Do NOT wipe undelete information
--nowfs Do NOT wipe free space on file system
--no-wipe-zero-blocks Do NOT wipe all-zero blocks on file system (useful for
virtual/sparse devices, where empty areas are read as
all-zeros and do not take physical space unless
actually written to)
--use-dedicated Use the program dedicated for the given filesystem
type if supported. Fallback to WipeFreeSpace if
unsupported (currently, only 'ntfswipe' is supported)
--use-ioctl Disable device caching during work (can be DANGEROUS).
NOTE: this may not work for sub-partitions on drives.
To disable the cache, run the 'hdparm' utility with
the correct options to disable the cache before
running wipefreespace and enable the cache afterwards.
-v|--verbose Verbose output. Use twice for more. This also enables
progress bars, but be warned: these may not always be
accurate or increase at a constant rate.
-V|--version Print version number
The '/dev/XY' part stands for a device with a supported file system.
Examples: /dev/hda1, /dev/fd0. More than one device can be given on the
command line, but they will be wiped sequentially, NOT in
multiple threads. WipeFreeSpace is not multi-threaded and probably
won't be, because the libraries used can be not thread-safe.
But, you can run multiple WipeFreeSpace processes (but not wiping the same
filesystem) in multiple terminals (or under screen/nohup) as a substitute
for multi-threading.
The following method names (case-insensitive) are available:
- Gutmann (method similar to Gutmann's, the default, 36 passes)
- random (shred-like, 25 passes)
- schneier (Shneier's method, 7 passes, contains ITSG-06)
- dod (DoD, 3 passes, contains NAVSO P-5239-26 and German Federal
Office for Information Security)
Each given filesystem is wiped ONLY ONCE, no matter how many times it
appears on the command line.
WipeFreeSpace also works for file systems created inside regular
files on any host file system.
NOTE: wiping with just one pattern at a time (-n 1) will NOT perform wiping
with all patterns of the given method one by one, it will always use the
first pattern. However, it will be MUCH faster than any "full" method.
If you need just random wiping, run
wipefreespace -n 1 /dev/XY
a few times in a row.
Any option affects all filesystems given on the command line, not just
the ones following it.
To perform a command after wiping (like sending e-mail), simply run a
program after WipeFreeSpace is finished, for example:
wipefreespace [options] /dev/XY; mail [options]
or in a script:
#!/bin/bash
wipefreespace [options] /dev/XY
mail [options]
To run WipeFreeSpace with a higher or lower priority, simply use the
"renice" utility, for example:
renice +1 $(pidof wipefreespace)