Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Scalpel is a Linux utility which is traditionally used to recover files on the basis of file signatures, that is in a manner that is unaware of the file system.

Can we also use it for doing the contrary, i.e. erase content?

Assuming that the file header and footer signatures are known, is there a way to erase (zero-fill) the contents matched by scalpel to permanently delete files as well as their prior versions?

This would be to clean a computer before selling it and while keeping the softwares installed.

Extra question if possible: How would you delete or corrupt fragmented files, without risking to damage other files? Maybe carve with max file size, ignore footer, and delete only first sector of each match?

share|improve this question

1 Answer 1

As Scalpel is intended to recover files, I wouldn't try to securely remove files with it. There are different tools for that. First that come to mind are srm/sfill, wipe and shred but there are more.

The problem with removing just some files while leaving installed software intact is that

  • you have to (at least on some level) manually list each file to be removed
  • possibly forget to remove something sensitive anyway.

Personally, I'd use DBAN to wipe the whole thing first, re-installing if really needed. Much quicker and safer that way.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.