40

I've just updated to macOS 10.12 and when I try to execute srm in Terminal, it says -bash: srm: command not found.

Is srm removed? How to fix this?

Stevoisiak
  • 1,631
Niktin Roman
  • 825
  • 1
    As a side note: srm was a dying project back in the early 2000's. Apple poured some resources into the project and it first appears in 10.3. You should be aware that using srm does not guarantee the data is not recoverable . – fd0 Sep 09 '16 at 19:54
  • @fd0, can you come up with a better idea or safely removing files from SSD on newer macs? – Niktin Roman Sep 09 '16 at 19:57
  • 1
    Full disk encryption, though I do not use it, and rm or empty Trash in the GUI. – fd0 Sep 09 '16 at 20:07
  • 4
    @NiktinRoman for SSDs srm is no more secure than rm - srm only makes sense for hard disks. I suspect this is the reason it has been removed – mmmmmm Oct 24 '16 at 11:24

8 Answers8

35

From this comment:

can you come up with a better idea or safely removing files from SSD on newer macs? – Niktin Roman

There's no need for srm; provided that TRIM is enabled on your machine1

TRIM support handles this for you. When you delete a file from your drive, the OS will mark the file space as "not in use" - this applies to any drive. On an SSD, unlike a HDD, a TRIM command is sent to wipe any data in that marked space. This allows your SSD to be able to write data to that marked space as if it was brand new and never used, and skip the traditional deletion process.

If you are looking for more security, turn on FileVault.

Per Apple Support:

Note: With an SSD drive, Secure Erase and Erasing Free Space are not available in Disk Utility. These options are not needed for an SSD drive because a standard erase makes it difficult to recover data from an SSD. For more security, consider turning on FileVault encryption when you start using your SSD drive.

I also advise against using srm because it issues more and unnecessary write operations to the SSD, thus shortening it's lifespan. From the man page:

srm  removes  each  specified file by overwriting, renaming, and
truncating it before unlinking

1 TRIM comes enabled by default if you your Mac came with an SSD preinstalled. if you added an SSD after the fact, then you must enable TRIM by issuing the command sudo trimforce enable in Terminal.
Allan
  • 101,432
  • 4
    This should be the accepted answer. – Mr. Lance E Sloan Jan 12 '17 at 19:56
  • Does TRIM mark the space this way when you rm the file in the terminal (the deleted file/s will not appear in Trash) or only if you delete "regularly" (move it to the Trash)? Thanks! – ScienceFriction Oct 19 '17 at 10:49
  • 1
    "Trash" is just a hidden folder in your home directory - ~/.Trash. So "moving a file to the trash" is just that - moving a file. When you empty the trash is when you actually delete the file. When the file is actually deleted via this method or via rm is when TRIM takes effect. – Allan Oct 19 '17 at 11:12
  • 3
    The TRIM command should not be trusted to reliably erase data on an SSD. It simply allows the OS to tell the SSD that certain blocks are no longer in use. It is up to the SSD firmware controller to implement TRIM correctly. Drive manufacturers don't have a good track record here. Even the stronger "secure erase" ATA command is implemented inconsistently, even sometimes reporting success when all data remained on the drive. See https://cseweb.ucsd.edu/~swanson/papers/Fast2011SecErase.pdf for more info. – William Budington Jul 11 '18 at 00:57
  • 1
    @WilliamBudington - your information is woefully out of date. See this post: https://apple.stackexchange.com/questions/269863/can-the-data-on-an-macbook-pro-ssd-be-recovered-after-formatting-using-disk-util/269916#269916 – Allan Jul 11 '18 at 09:33
  • @WilliamBudington - your entire premise (and paper that you cite) is based on pre-SATA 3.1 specifications. The forensic papers I link to specifically state that it is now impossible, with modern firmware to recover data. – Allan Jul 13 '18 at 00:25
  • @Allan one of the the very forensic papers you cite specifically mentions that "SSD drives are extremely complex devices requiring extremely complex firmware to operate. Many SSD drives were released with buggy firmware effectively disabling the effects of TRIM and garbage collection." This holds true regardless of whether the drive supports DRAT or DZAT. Further, this relies on trust of the firmware controller to actually report the bits faithfully. If it isn't doing that, sophisticated forensic tools should be able to recover the bits on the drive at indeterminate cost. – William Budington Jul 13 '18 at 01:13
  • @WilliamBudington - yes. All PRE- 3.1 spec. Your conflating old tech with new. – Allan Jul 13 '18 at 01:18
31

rm has a -P switch that will overwrite the file three times before deleting. Better than nothing, I suppose.

Tom
  • 311
  • In this use case, this is technically correct. Three times nothing is better than nothing. – Rimian Aug 13 '19 at 01:17
  • Here's what the man page says about the -P switch (in macOS 12 Monterey):

    "This flag has no effect. It is kept only for backwards compatibility with 4.4BSD-Lite2."

     – Steven Klein Jun 23 '22 at 20:51
10

UPDATE: In recent macos versions (released in ~2021 or later) this does not work anymore

To securely delete a file/folder on MacOS Sierra without external utilities use rm with the -P switch:

## delete a single file
rm -Pv wikileak1.txt

delete a folder recursively


rm -Pvrf ~/.wikileaks

From the man page:

 -P          Overwrite regular files before deleting them.  Files are

             overwritten three times, first with the byte pattern 0xff,
             then 0x00, and then 0xff again, before they are deleted.

 -v          increase verbosity

NOTE: In case you installed GNU coreutils from homebrew with the default names, e.g. brew install coreutils --default-names, then, depending on how you configured your PATH, the GNU version of rm could shadow the Mac version at /bin/rm and it won't accept the -P option. Use which -a rm to double-check.

ccpizza
  • 2,995
  • 3
  • 36
  • 41
9

Since this question was originally answered two things have happened:

  • homebrew-dupes was merged into homebrew-core
  • srm was deleted from homebrew-core

If you try to install it now it will give you details of the deleting commit and a suggestion to create your own tap if you still need it. I have done so here.

You can install it using Homebrew: brew install khell/homebrew-srm/srm

Cameron Yan
  • 91
3

Not yet running macOS 10.12 however under OS X 10.8.5 the man page for srm in the NOTES section states:

Development and discussion of srm is carried out at <http://sourceforge.net/project/?group_id=3297>, which is also accessible via <http://srm.sourceforge.net>.

Now you'd have to download the source code and compile it for yourself. This would require Command Line Tools for Xcode be installed. Not sure if still applicable under macOS 10.12 however, see How to Install Command Line Tools in OS X Mavericks & Yosemite (Without Xcode) for details. Or in Terminal use the following command: xcode-select --install

I downloaded the latest source code and it compiled without errors under OS X 10.8.5, although that doesn't mean it will under macOS 10.12 but it's probably the only choice you've got if srm has been removed.

That said, I probably would only srm on rotational HDD's not SSD's.

user3439894
  • 58,676
  • 3
    NB srm is available in homebrew/dupes if you use homebrew. It will complain that MacOS already provides this software. That is not true in Sierra, but in any case to use homebrew to install it you must brew install srm && brew link --force srm – kojiro Oct 08 '16 at 22:49
  • 2
    @kojiro doesn't work. "srm was deleted from homebrew/core in commit 7957c4b98" – AfterWorkGuinness May 10 '17 at 14:48
  • @AfterWorkGuinness True, Apple ostensibly removed srm because they thought it would destroy people's ssds. https://github.com/Homebrew/homebrew-dupes/issues/725. I'm somewhat skeptical that they had exactly that reason in mind, but the point remains that secure-delete commands are less useful on ssd than spinning rust. (It probably never occurs to Apple that someone might want to hook up a spinning rust dist.) – kojiro May 10 '17 at 14:52
2

Use Homebrew, as suggested here:

brew install homebrew/dupes/srm
brew link --force srm
Community
  • 1
n1000
  • 7,714
1

There are plenty of good reasons not to use secure deletion tools (srm, shred, rm -P, etc) on modern systems (with TRIM-enabled SSDs and/or journalled file systems). @Allan's answer in particular is spot on.

However, if you really, really want to restore srm, someone's published a Homebrew tap here that works. Ie:

brew install khell/homebrew-srm/srm
srm secrets.txt

(After you've installed Homebrew, obviously.)

Molomby
  • 233
  • 3
  • 6
-3

sudo port install srm that will do

Roberto Domingos
  • 1
  • 3
    It will probably lead to a -bash: port: command not found error, so some more details may be required here. – nohillside Nov 01 '16 at 15:30
  • 1
    Install macports: https://www.macports.org/install.php – eggonlegs Nov 15 '16 at 19:28
  • This is what I did when Macports got uninstalled during some OS upgrade presumably. This is the preferred method in my book, but not a full answer so can't up-vote... oh well. The command I then used *sudo srm -RfvD TargetDirectoryToWipe*. Not on an SSD... – NOTjust -- user4304 Jun 23 '18 at 17:39