10

From my experience a file deleted from a computer filesystem can often be recovered unless it is overwritten with a special program (that's usually called "shredding").

Is an Android-based HTC smartphone any different? How can a specific file be deleted from such smartphone so that the file can't possibly be recovered?

3

4 Answers 4

8

That is unfortunately not so easy.

Since there is not API for the secure deletion of files, it would require root for the "secure delete app" in order to achieve block level access to the storage device. Only access to the blocks of the deleted file eventually allows an app to overwrite the leftovers of the file with random data. Eventually, because the flash storage device could perform wear leveling. If that's the case, block #42 wouldn't be always the same physical block, which makes the system calls ineffective.

I think that's why there isn't a secure delete solution for android yet. At least I couldn't find one on XDA.

4
  • Could a program possibly open an existing file, overwrite it all with trash, close the file and then delete it?
    – sharptooth
    Commented Oct 19, 2011 at 7:14
  • You could program that. But it will be useless, because it is not guaranteed the overwrite will happen on the same physical blocks as the existing data.
    – Flow
    Commented Oct 19, 2011 at 7:17
  • 1
    Do you mean the filesystem or some other entity will transparently relocate the new written data to new location and mark previously occupied location free?
    – sharptooth
    Commented Oct 19, 2011 at 7:38
  • 1
    Yes, it's the choice of the OS where it wants to write new data for various reasons (fragmentation, etc.) and what nearly every modern OS does that. Even if not, there is still the layer where wear leveling could happen.
    – Flow
    Commented Oct 19, 2011 at 7:45
3

One simple solution would be to delete the file, then fill the memory with any other data so the space previously owned by the deleted file is sure to get overwritten.

Once the memory is filled up, the file(s) used for the filling can be removed, releasing the space again - only now recovery attempts will find only the filler file, not the original deleted file.

Note that this is intended only for combatting simple home recovery tools like testdisk. There may in theory still be ways to recover at least parts, or even the entire original file - however they would require some sophisticated high-end analysis methods. One example of such a method would be to analyze if some of the data is preserved because of flash wear leveling. However this isn't easily done, and AFAIK would require connecting the memory card to a custom reader device of some sort, and might even require taking the memory device apart.

3
  • Wear leveling on most Flash media will not always guarantee that overwriting the file will write over the same physical location on the memory. en.wikipedia.org/wiki/Wear_leveling
    – Chahk
    Commented Oct 19, 2011 at 14:13
  • @Chahk, Yes, I agree, that's why I included the "sophisticated methods" disclaimer. Point is, it's trivial to recover a normally deleted file using home tools like testdisk. If there are some easy-to-use home tools to recover content that's been spared because of flah wear leveling, I've never heard of them. Note that I never said this data flooding would be an absolute method, but quite probably something strong enough for the asker's needs. Commented Oct 19, 2011 at 19:22
  • I added more details to the disclaimer to improve my answer, and now mention analyzing flash wear leveling as one example of a possible remaining attack vector. Commented Oct 19, 2011 at 19:36
1

If you connect your device as a disk drive, you can use a utility like sdelete on Windows to securely delete files. http://technet.microsoft.com/en-us/sysinternals/bb897443

From the web page: "SDelete implements the Department of Defense clearing and sanitizing standard DOD 5220.22-M, to give you confidence that once deleted with SDelete, your file data is gone forever."

5
  • Will it help against wear leveling mentioned in this answer android.stackexchange.com/questions/14739/… ?
    – sharptooth
    Commented Oct 24, 2011 at 8:05
  • In all honesty, I have no idea. I don't even know whether there are any Android devices that implement wear leveling. Since it overwrites the original sectors, I would expect it to be unaffected by wear leveling. Commented Oct 25, 2011 at 5:36
  • Well, if there is wear leveling this program is affected - it does no magic, just opens the file for writing (like any other program would) and writes garbage there, then closes the file. If there's wear leveling the program can't possible know - it uses usual operating system primitives.
    – sharptooth
    Commented Oct 25, 2011 at 6:36
  • I wonder whether using the clean option a few times would provide protection against wear leveling. Since it's beyond our control, cleaning free space a few times ought to "find" the freed sectors and erase them. Commented Oct 26, 2011 at 5:35
  • Maybe, but I suppose it would take a lot of time.
    – sharptooth
    Commented Oct 28, 2011 at 6:02
1

If the file is on a sdcard then you could insert the sdcard into your notebook card reader and use srm, sdelete or whatever you usually use on your desktop for secure file deletion.

If the file is in the internal memory then probably the only reliable way to completely delete any trace of it (and everything else on the phone) would be to enable full phone encryption in Settings > Security, wait until everything is encrypted (about one hour), and then do a factory reset.

There are also apps in the play store that allegedly can wipe the free space with DoD level algorithms, but I have no idea how good they are or how they work.

And btw, keep in mind that flash memory has a limited number of read-write cycles, so running those apps too often can potentially reduce the memory chip lifetime.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .