Tell me more ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.
up vote 6 down vote favorite

From my experience a file deleted from a computer filesystem can often be recovered unless it is overwritten with a special program (that's usually called "shredding").

Is an Android-based HTC smartphone any different? How can a specific file be deleted from such smartphone so that the file can't possibly be recovered?

share|improve this question
Are you only looking for phone-hosted options, or would you accept suggestions about deleting the file when the phone is connected as a disk drive? – Bernhard Hofmann Oct 19 '11 at 11:08
@Bernhard Hofmann: Well, if connecting as a drive makes such action easier - it's much better than nothing. – sharptooth Oct 19 '11 at 11:38

3 Answers

up vote 6 down vote accepted

That is unfortunately not so easy.

Since there is not API for the secure deletion of files, it would require root for the "secure delete app" in order to achieve block level access to the storage device. Only access to the blocks of the deleted file eventually allows an app to overwrite the leftovers of the file with random data. Eventually, because the flash storage device could perform wear leveling. If that's the case, block #42 wouldn't be always the same physical block, which makes the system calls ineffective.

I think that's why there isn't a secure delete solution for android yet. At least I couldn't find one on XDA.

share|improve this answer
Could a program possibly open an existing file, overwrite it all with trash, close the file and then delete it? – sharptooth Oct 19 '11 at 7:14
You could program that. But it will be useless, because it is not guaranteed the overwrite will happen on the same physical blocks as the existing data. – Flow♦ Oct 19 '11 at 7:17
Do you mean the filesystem or some other entity will transparently relocate the new written data to new location and mark previously occupied location free? – sharptooth Oct 19 '11 at 7:38
Yes, it's the choice of the OS where it wants to write new data for various reasons (fragmentation, etc.) and what nearly every modern OS does that. Even if not, there is still the layer where wear leveling could happen. – Flow♦ Oct 19 '11 at 7:45
up vote 3 down vote

One simple solution would be to delete the file, then fill the memory with any other data so the space previously owned by the deleted file is sure to get overwritten.

Once the memory is filled up, the file(s) used for the filling can be removed, releasing the space again - only now recovery attempts will find only the filler file, not the original deleted file.

Note that this is intended only for combatting simple home recovery tools like testdisk. There may in theory still be ways to recover at least parts, or even the entire original file - however they would require some sophisticated high-end analysis methods. One example of such a method would be to analyze if some of the data is preserved because of flash wear leveling. However this isn't easily done, and AFAIK would require connecting the memory card to a custom reader device of some sort, and might even require taking the memory device apart.

share|improve this answer
Wear leveling on most Flash media will not always guarantee that overwriting the file will write over the same physical location on the memory. en.wikipedia.org/wiki/Wear_leveling – Chahk Oct 19 '11 at 14:13
@Chahk, Yes, I agree, that's why I included the "sophisticated methods" disclaimer. Point is, it's trivial to recover a normally deleted file using home tools like testdisk. If there are some easy-to-use home tools to recover content that's been spared because of flah wear leveling, I've never heard of them. Note that I never said this data flooding would be an absolute method, but quite probably something strong enough for the asker's needs. – Ilari Kajaste Oct 19 '11 at 19:22
I added more details to the disclaimer to improve my answer, and now mention analyzing flash wear leveling as one example of a possible remaining attack vector. – Ilari Kajaste Oct 19 '11 at 19:36
up vote 1 down vote

If you connect your device as a disk drive, you can use a utility like sdelete on Windows to securely delete files. http://technet.microsoft.com/en-us/sysinternals/bb897443

From the web page: "SDelete implements the Department of Defense clearing and sanitizing standard DOD 5220.22-M, to give you confidence that once deleted with SDelete, your file data is gone forever."

share|improve this answer
Will it help against wear leveling mentioned in this answer android.stackexchange.com/questions/14739/… ? – sharptooth Oct 24 '11 at 8:05
In all honesty, I have no idea. I don't even know whether there are any Android devices that implement wear leveling. Since it overwrites the original sectors, I would expect it to be unaffected by wear leveling. – Bernhard Hofmann Oct 25 '11 at 5:36
Well, if there is wear leveling this program is affected - it does no magic, just opens the file for writing (like any other program would) and writes garbage there, then closes the file. If there's wear leveling the program can't possible know - it uses usual operating system primitives. – sharptooth Oct 25 '11 at 6:36
I wonder whether using the clean option a few times would provide protection against wear leveling. Since it's beyond our control, cleaning free space a few times ought to "find" the freed sectors and erase them. – Bernhard Hofmann Oct 26 '11 at 5:35
Maybe, but I suppose it would take a lot of time. – sharptooth Oct 28 '11 at 6:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.