How I can make rm to single pass secure delete items in macOS?

Question

According to the rm man page rm -P ... overwrites items three times to delete them securely:

-P            Overwrite regular files before deleting them. Files are
                overwritten three times, first with the byte pattern 0xff,
                then 0x00, and then 0xff again, before they are deleted.

Is it possible to single pass secure delete items with rm ...?

Notes:

• I don't want to use srm! I need rm only, please.
• I use a MacBook with an HDD and macOS 10.13.

Answer 1

No, that is not possible with the standard rm command.

You could download the rm source code (rm.c) from opensource.apple.com and edit the rm_overwrite() function to only do a single pass.

Or you could use an alternative program that overwrites the file, and then afterwards use rm to delete it. Such an alternative program could just be to use cat or dd to copy bytes from /dev/urandom or /dev/null over the file.

Answer 2

You can't have rm do something that it doesn't have the capability of doing. On the other hand srm was designed expressly for this purpose. So, how do you get rm to do something that srm does out of the box?

Make an Alias

If you want to "use" (the command; not the actual program) rm to do a single pass, use an alias. To do this, you will need to have srm installed on your system (available in MacPorts).

$ alias rm="srm -s"

Now, anytime you issue the command rm it will actually be calling srm with the -s flag for "single pass overwrite".

Usage example: Suppose you have a directory called foo with a number of files that you want to delete. Issue the command

$ rm -rf foo

and what will actually be executed is:

$ srm -s -rf foo

Make the Alias permanant

Edit your ~/.bash_profile and add the alias entry. Restart your bash session and the "one pass rm command" will now be available.

Answer 3

As mentioned in this answer file overwriting is no longer a suitable way to ensure file are securely deleted on machines with SSD drives as the way the way files are stored/deleted on them is different due to underlying systems that provide for wear-leveling, efficiency, etc. Also journaling filesystems can complicate things.

The best approach is to use Apple's FileVault so any deleted files only potentially persist as encrypted fragments.

If you are using some other/older types of drives overwriting can help to ensure files are properly deleted. In which case there's GNU's gshred which can be installed as part of the GNU coreutils package e.g. using brew:

brew install coreutils

The gshred tool allows for control over the number of overwrites using the -n arg and also allows for control over how the deletion occurs using the --remove arg. So to only overwrite once and unlink the file use:

gshred -n 1 --remove=unlink file_to_overwrite_and_delete