How to Permanently Delete Files: Secure Deletion Methods

Deleting a file doesn't actually remove it. Your operating system just marks that disk space as available and moves on — the data itself sits right where it was, waiting for anyone with the right software to find it. For most files that's fine, but for anything sensitive, it's a real problem.

Think about who needs to get this right: journalists protecting sources, doctors storing patient records, businesses handling financial data. If you've ever sold a laptop, returned a work computer, or thrown out an old hard drive without wiping it, there's a good chance those "deleted" files were still perfectly readable.

Why Standard Deletion Fails

Speed is what operating systems optimize for, not security. When you delete a file, the system updates its file table to flag those sectors as reusable — but it doesn't touch the actual data. It's like crossing a book's title off the library catalog while leaving the book on the shelf. Anyone who knows to look can still read it.

Recovery tools exploit exactly this behavior. Free programs like PhotoRec and TestDisk scan "empty" disk space for data patterns and reconstruct deleted files with surprisingly high success rates. Law enforcement and forensic labs go further, using magnetic force microscopy to recover data even after basic overwriting attempts.

The risk doesn't stop with your current device either. Every file you thought you deleted goes with it when you sell a laptop or return company hardware. Cloud storage and backup systems make this messier — files synced before deletion often persist in version history or backup snapshots long after you've removed them locally.

Overwriting Methods

The core idea behind secure deletion is straightforward: overwrite the data with random or patterned information so the original becomes unrecoverable. One pass is usually enough on modern hardware. NIST updated its guidance back in 2014 to confirm that single-pass overwriting provides sufficient protection for current drives.

Single-Pass Overwriting

On Linux and macOS, shred handles this cleanly:

# Overwrite file 3 times with random data, then delete
shred -vfz -n 3 sensitive_document.pdf

# Single pass for faster deletion
shred -vfz -n 1 financial_records.xlsx

# Wipe entire partition (use with extreme caution)
sudo shred -vfz -n 1 /dev/sdb1

The flags break down like this: -v shows progress, -f forces permission changes to allow deletion, -z adds a final zero-pass to hide the fact that shredding happened, and -n sets the number of passes.

Windows has the built-in cipher command, though it only wipes free space rather than targeting specific files:

# Wipe free space on C: drive with 3 passes
cipher /w:C:\

# Note: cipher only wipes free space, not specific files
# Use with SDelete for individual files

For individual files on Windows, Microsoft's SDelete utility from Sysinternals gives you more precise control:

# Single-pass secure deletion
sdelete -p 1 sensitive_data.docx

# Multi-pass with DoD 5220.22-M standard
sdelete -p 7 classified_info.pdf

Multi-Pass Standards

Before modern drives, there were legitimate concerns about magnetic residue surviving overwrites — which is where standards like DoD 5220.22-M (7 passes) and the Gutmann method (35 passes) came from. These days, those concerns don't apply to current hardware, but certain compliance frameworks still require them.

“There are only two types of companies: those that have been hacked and those that will be.”

— Robert Mueller

The tradeoff is time. A single-pass wipe of a 1TB drive takes a few hours. With 35 passes, you're looking at days.

File System Considerations

Not all storage is created equal, and the same technique that works perfectly on a traditional hard drive may fall short on an SSD.

Hard Disk Drives

Spinning disks are predictable. Data lives at fixed physical locations, so sector-by-sector overwrites work exactly as expected. The main thing to watch out for is ensuring you catch all copies — temporary files, swap space, and file system journals can hold remnants of data you thought you'd cleared.

Solid-State Drives and Flash Storage

SSDs complicate things considerably. Wear-leveling algorithms distribute writes across memory cells to extend drive life, which means when you overwrite a file, the SSD may write to a completely different physical location and simply mark the old one as available rather than erasing it. Standard overwriting tools have no visibility into this — they can't reliably reach the original data.

The ATA Secure Erase command is the right approach here. It tells the drive's own controller to wipe every cell it knows about, including spare blocks the operating system can't see:

# Check if drive is frozen (most are at boot)
sudo hdparm -I /dev/sda | grep frozen

# If frozen, suspend and resume system to unfreeze
# Then issue secure erase
sudo hdparm --user-master u --security-set-pass password /dev/sda
sudo hdparm --user-master u --security-erase password /dev/sda

For NVMe drives, use nvme-cli instead:

# Check sanitize capabilities
sudo nvme id-ctrl /dev/nvme0 -H | grep -i sanitize

# Execute cryptographic erase if supported
sudo nvme sanitize /dev/nvme0 -a 0x02

TRIM support on SSDs does clear deleted blocks, but it works asynchronously in the background. Don't count on it for anything time-sensitive.

Encryption as a Deletion Strategy

Full-disk encryption changes the game entirely. When your drive is encrypted, every byte on the physical media is ciphertext. Deleting the encryption key makes all of it unrecoverable — it doesn't matter whether individual files were securely deleted or not. There's nothing useful left to recover.

Windows, macOS, and Linux all ship with solid built-in options: BitLocker, FileVault, and LUKS respectively. For high-stakes situations, you can combine full-disk encryption with targeted file deletion to get both layers:

# Linux LUKS encryption setup
sudo cryptsetup luksFormat /dev/sdb1
sudo cryptsetup luksOpen /dev/sdb1 secure_volume

# After use, closing the volume and deleting keys makes data unrecoverable
sudo cryptsetup luksClose secure_volume
sudo cryptsetup luksErase /dev/sdb1

File-level tools like VeraCrypt create encrypted containers that work the same way — securely delete the key file and the contents become inaccessible:

# Create encrypted container
veracrypt -c --volume-type=normal --size=1G --encryption=AES \
  --hash=SHA-512 --filesystem=FAT sensitive_data.vc

# Securely delete the key after unmounting
shred -vfz -n 3 sensitive_data.vc

Comparison of Deletion Methods