Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Scalpel is a Linux utility which is traditionally used to recover files on the basis of file signatures, that is in a manner that is unaware of the file system.

Can we also use it for doing the contrary, i.e. erase content?

Assuming that the file header and footer signatures are known, is there a way to erase (zero-fill) the contents matched by scalpel to permanently delete files as well as their prior versions?

This would be to clean a computer before selling it and while keeping the softwares installed.

Extra question if possible: How would you delete or corrupt fragmented files, without risking to damage other files? Maybe carve with max file size, ignore footer, and delete only first sector of each match?

share|improve this question

As Scalpel is intended to recover files, I wouldn't try to securely remove files with it. There are different tools for that. First that come to mind are srm/sfill, wipe and shred but there are more.

The problem with removing just some files while leaving installed software intact is that

  • you have to (at least on some level) manually list each file to be removed
  • possibly forget to remove something sensitive anyway.

Personally, I'd use DBAN to wipe the whole thing first, re-installing if really needed. Much quicker and safer that way.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .