When you delete a file normally, the data stays on the disk — the filesystem just marks the space as available. The data can be recovered with the right tools. If you need to make sure it is really gone, you can overwrite it securely.
shred -vzf -n 5 /dev/sdb
The -v flag shows progress, -z adds a final overwrite with zeros to hide the fact that shredding took place, -n specifies the number of passes (5 in this example), and the device is the disk or partition you want to wipe.
Be careful with this command — there is no undo. Double-check the device name before running it.
Shredding a single file
If you only need to destroy a specific file rather than an entire disk, use shred on a file directly:
shred -vzu sensitive-file.pdf
The -u flag tells shred to delete the file after overwriting it. Without -u the file remains in place but with its content overwritten.
Wiping with dd for more control
If you want to see exactly what is being written and you know the disk size, dd gives you more control:
sudo dd if=/dev/urandom of=/dev/sdb bs=4096 status=progress
This writes random data in 4K blocks and shows a progress indicator. Replace urandom with zero (if=/dev/zero) for a faster but less thorough wipe. The trade-off is that a single zero pass is detectable — someone with specialised equipment can still read the residual magnetic signature.
Verifying the wipe
After wiping a disk, you can verify that no readable data remains:
sudo xxd /dev/sdb | head
If the output shows consistent patterns (all zeros or all random bytes), the wipe was successful. If you see fragments of old filesystem structures, you might need another pass.
Note on SSDs
Shred relies on overwriting the same physical sectors multiple times. On modern SSDs, wear-levelling and TRIM make this unreliable — the drive may remap sectors and leave old data in place. For SSDs, use the ATA Secure Erase command built into the drive firmware instead. Most Linux distributions include the hdparm or nvme-cli tools for this:
sudo hdparm --user-master u --security-set-pass p /dev/sdb
sudo hdparm --user-master u --security-erase p /dev/sdb
Or for NVMe drives:
sudo nvme format /dev/nvme0n1 -s1
The best defence against needing to wipe a disk securely is full-disk encryption. If the drive was encrypted from day one, a single pass of zeros is enough to make the data unrecoverable — the encryption keys are gone, and the rest is ciphertext.
Enjoy!
