I was intending to look at this at some stage.
Configuration is a good thing here to support various devices and security standards.
Some notes I have for various options:
none
Don't bother, or leave to lower layers (see discard)
zero
dd bs=1M if=/dev/zero
shred
# doesn't use /dev/urandom by default as very slow and overkill
# uses 3 passes by default
# does not yet support DoD 5220 rules
# does not yet support ATA secure erase
discard
# benefits on SSDs to return blocks to pool and efficiently erase
# some devices don's zero on discard. See /sys/block/$dev/queue/discard_zeroes_data
# lvm supports directly since 2.02.85 (04/2011) with issue_discards=1 in /etc/lvm/lvm.conf
# manual trim call with hdparm --trim-sector-ranges. That's a bit awkward though...
# ... must look into adding simple support to some command (fstrim, truncate,shred?)
# Note mkfs.* generally do a trim of the device first anyway
I'd not considered a partial overwrite of the start of the device,
as discussed in the referenced email thread. Does that provide
any functional benefit?
I was intending to look at this at some stage.
Configuration is a good thing here to support various devices and security standards.
Some notes I have for various options:
none $dev/queue/ discard_ zeroes_ data sector- ranges. That's a bit awkward though...
Don't bother, or leave to lower layers (see discard)
zero
dd bs=1M if=/dev/zero
shred
# doesn't use /dev/urandom by default as very slow and overkill
# uses 3 passes by default
# does not yet support DoD 5220 rules
# does not yet support ATA secure erase
discard
# benefits on SSDs to return blocks to pool and efficiently erase
# some devices don's zero on discard. See /sys/block/
# lvm supports directly since 2.02.85 (04/2011) with issue_discards=1 in /etc/lvm/lvm.conf
# manual trim call with hdparm --trim-
# ... must look into adding simple support to some command (fstrim, truncate,shred?)
# Note mkfs.* generally do a trim of the device first anyway
I'd not considered a partial overwrite of the start of the device,
as discussed in the referenced email thread. Does that provide
any functional benefit?