Linux shred Command: Overwrite File Data and Understand Its Limits

This guide explains how to Linux shred overwrites file data, which options control its passes and removal, and why SSDs, snapshots, backups, and modern filesystems limit its guarantees. It focuses on practical Linux usage, predictable automation, and the cases where a seemingly small path or option mistake can change the result.

The examples use GNU Coreutils behavior. Check shred --help, man shred, and your distribution documentation when portability or a version-specific option matters.

What Is the shred Command?

shred repeatedly writes patterns over a file or device to make previous data harder to recover. Its assumptions do not hold reliably on SSDs, copy-on-write filesystems, snapshots, backups, RAID layers, or storage that remaps blocks, so it cannot promise removal of every copy.

Basic Syntax

shred [OPTION]... FILE...

Quote paths that contain spaces. When supported, place -- before operands that begin with a hyphen so they are not interpreted as options.

Basic shred Usage

Overwrite a file

The default operation overwrites data but leaves the directory entry. Test behavior on disposable data before using it on an important path.

shred secret.txt

Overwrite and remove the file

Add -u to remove the file after the overwrite passes. This still does not erase copies in other storage layers.

shred -u secret.txt

Display progress

Use -v for progress information when processing a large file or a carefully identified device.

shred -v -n 3 disk-image.raw

Distinguishing between completion messages and actual deletion guarantees

shred shows progress depending on the options, but finishing without errors does not guarantee that all copies on physical storage media have been erased. The following applies only to test files created directly.

printf 'demo\n' > disposable-demo.txt
shred -u disposable-demo.txt
test ! -e disposable-demo.txt
echo $?

Example output 0 only confirms that the file name has disappeared. Data remaining on SSDs, snapshots, journaling filesystems, or backups must be considered separately.

Key Options

Long options often make reviewed scripts easier to understand. When a script must run on non-GNU systems, verify every non-POSIX option on the target platform.

Practical Examples

Use a limited pass count

More passes increase time, but modern storage behavior matters more than a large pass count. Define the storage model and threat before choosing this tool.

shred -v -n 1 -z -u confidential.bin

Identify a block device first

An incorrect device path can destroy another disk. Unmount the target and confirm size, model, serial number, and mount relationships using more than one check.

lsblk -o NAME,SIZE,MODEL,SERIAL,FSTYPE,MOUNTPOINTS
findmnt

Consider cryptographic erasure

When full-disk encryption was used from the start, securely destroying the encryption key can be an important disposal method. Also consider vendor secure erase, organizational policy, and physical destruction requirements.

cryptsetup status encrypted-volume

shred and Related Commands

Important Cautions

SSD writes may reach different physical cells

Wear leveling and spare blocks mean that rewriting a logical address may not overwrite the cell that held the old data.

Other filesystem copies can remain

Journals, snapshots, copy-on-write extents, RAID, synchronization, and backups may retain data beyond the named file.

A device path mistake is destructive

Shredding a block device can erase an entire filesystem. Confirm identity, mount state, backups, and authorization before proceeding.

FAQ

Does shred -u guarantee that recovery is impossible?

No. Storage remapping, filesystems, snapshots, and backups can retain other copies.

Should I shred individual files on an SSD?

Individual overwrites are unreliable because of wear leveling. Prefer encryption and a supported device sanitization procedure.

Does -z make deletion more secure?

It adds a final zero pass but does not remove copies elsewhere or guarantee sanitization.

Should ordinary deletion use rm or shred?

Use rm for ordinary deletion. Use shred only after evaluating the storage technology and threat model.

Related Resources

• Essential Linux Commands: A Practical Reference by Task
• GNU Coreutils shred documentation
• GNU Coreutils manual