≡ Menu

Linux AWS: Find And Delete All Files Securely So That No One Can Recover It Ever

I‘m currently using Amazon EBS block level storage volumes for use with Amazon EC2 instances powered by Red Hat Enterprise Linux. This volume stores critical webapp and user data. We are moving out to another cloud provider. How do I find files such as *.logs, *.php, *.gz and few other file patterns and securely delete them so that no one can recover it ever?

You need to use disk scrubbing program such as scrub. It overwrites hard disks, files, and other devices with repeating patterns intended to make recovering data from these devices more difficult. Although physical destruction is unarguably the most reliable method of destroying sensitive data, it is inconvenient and costly. For certain classes of data, organizations may be willing to do the next best thing which is scribble on all the bytes until retrieval would require heroic efforts in a lab. The scrub implements several different algorithms.

Install scrub on RHEL / CentOS / Fedora Linux

Type the following yum command to install the scrub software:
# yum install scrub
Sample outputs:

Loaded plugins: product-id, protectbase, rhnplugin, subscription-manager
Updating certificate-based repositories.
Unable to read consumer identity
0 packages excluded due to repository protections
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package scrub.x86_64 0:2.2-1.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

 Package      Arch          Version           Repository                   Size
 scrub        x86_64        2.2-1.el6         rhel-x86_64-server-6         34 k

Transaction Summary
Install       1 Package(s)

Total download size: 34 k
Installed size: 0  
Is this ok [y/N]: y
Downloading Packages:
scrub-2.2-1.el6.x86_64.rpm                               |  34 kB     00:00     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : scrub-2.2-1.el6.x86_64                                       1/1 
Installed products updated.
  Verifying  : scrub-2.2-1.el6.x86_64                                       1/1 

  scrub.x86_64 0:2.2-1.el6                                                      


How do I use scrub?

The syntax is:

scrub fileNameHere
scrub file.txt

Sample outputs:

scrub: using NNSA NAP-14.x patterns
scrub: padding file.txt with 4029 bytes to fill last fs block
scrub: scrubbing file.txt 4096 bytes (~4KB)
scrub: random  |................................................|
scrub: random  |................................................|
scrub: 0x00    |................................................|
scrub: verify  |................................................|

How do I select the pattern to write?

Use the following sytnax:
scrub -p nnsa|dod|bsi|old|fastold|gutmann|random|random2 fileNameHere

Select the patterns to write. nnsa selects patterns compliant
with NNSA Policy Letter NAP-14.x; dod selects patterns compliant
with DoD 5220.22-M; bsi selects patterns recommended by the Ger-
man Center of Security in Information Technologies
(http://www.bsi.bund.de); old selects pre-version 1.7 scrub pat-
terns; and fastold is old without the random pass. gutmann is a
35-pass sequence described in Gutmann’s paper cited below. See
STANDARDS below for more detail. random is a single random
pass. random2 is two random passes. Default: nnsa.

However, from the man page:

The effectiveness of scrubbing regular files through a file system will be limited by the OS and file system. File systems that are known to be problematic are journaled, log structured, copy-on-write, versioned, and network file systems. If in doubt, scrub the raw disk device. In other words, you need to scrub the eniter raw device such as /dev/sdb or /dev/sdvf.

Sample command:

scrub -p dod /dev/sdvf

How do I use scrub over the remote ssh session?

First, login using the ssh client. Next, start a screen manager that multiplexes a physical terminal between several processes such as screen or tmux:
$ ssh -i my.aws.appkey.pem user@ec2-46-51-239-52.ap-northeast-1.compute.amazonaws.com
$ sudo -s
# screen
# scrub -p dod /dev/sdvf

You can now close the ssh session and logout. It may take several hours or days. It all depends upon your EBS storage volumes size.

How do I securely delete selected files?

Use the find command as follows over the ssh+screen session:

### delete all php files ###
# find /path/to/ebs/mount/location -type f -iname \*.php  -print0 | xargs -0 -I{} scrub {} 
### delete all *.sql files ###
# find /path/to/ebs/mount/location -type f -iname \*.sql  -print0 | xargs -0 -I{} scrub {}

Editor’s note: The commands discussed here should work with any Linux distribution and any block level storage such as local, removable, raid based, cloud based and so on.

Share this tutorial on:

Your support makes a big difference:
I have a small favor to ask. More people are reading the nixCraft. Many of you block advertising which is your right, and advertising revenues are not sufficient to cover my operating costs. So you can see why I need to ask for your help. The nixCraft, takes a lot of my time and hard work to produce. If you use nixCraft, who likes it, helps me with donations:
Become a Supporter →    Make a contribution via Paypal/Bitcoin →   

Don't Miss Any Linux and Unix Tips

Get nixCraft in your inbox. It's free:

{ 8 comments… add one }
  • Liju October 26, 2012, 3:37 am

    I believe AWS would have proper mechanism in place to prevent this. Otherwise nobody won’t be used this service at all.

  • Mark October 26, 2012, 2:42 pm

    Are you positive AWS doesn’t make backup copies of instances? That’s one of the drawbacks of cloud services – nothing is guaranteed to be permanently deleted.

  • Joyce Babu October 26, 2012, 6:34 pm

    I have been with a few VPS providers. They have told me that when an account is cancelled, they destroy the entire virtual machine. And it is no longer possible to recover the data. Is it possible to recover the data from an other VPS on the same server?

  • George October 26, 2012, 7:15 pm

    As you can see from this research, it’s better to delete confidential data instead of just relying on your cloud provider to do it:


  • Chris October 27, 2012, 10:34 am

    I suggest you take a look at aws.amazon.com/security All decommissioned space is zeroed. This is still relevant for a number of other cloud services I can think of however – also any standard hosting you may manage.

  • scout October 28, 2012, 8:36 am

    I still think it’s better to securely remove any data you might have, than to rely on your provider.


    dd if=/dev/uranom of=/your/disk

    is also a way to securely remove any traces of your data.

  • Jalal Hajigholamali January 1, 2014, 4:44 am


    Thanks, useful article

  • eric October 17, 2015, 3:18 am

    Even better: architect the solution better? Go private cloud if your data shouldnt be “wandering” around.

    Also, you can scrub the disks and also let AWS do it later. No harm in that. It can be CPU intenstive though, not sure if you are paying for IOPS?

Security: Are you a robot or human?

Leave a Comment

You can use these HTML tags and attributes: <strong> <em> <pre> <code> <a href="" title="">

   Tagged with: , , , , ,