srm (Unix)

Attempting to secure delete a file with multiple hard links results in a warning from srm stating that the current access path has been unlinked, but the data itself was not overwritten or truncated. This is an undocumented feature of srm 1.2.8 on Mac OS X 10.9,[1] and is erroneously documented in 1.2.11 as a behaviour activated by the OpenBSD rm-compatible option -P.[2] However, in both the OS X and SourceForge srm implementations, the behaviour of unlinking but not overwriting multi-linked files is always active, as long as the platform reports hard links.[3][4]

srm 1.2.8 on Mac OS X 10.9[5] has a -n option, which means "overwrite file, but do not rename or unlink it."[1] However, if the file has multiple links, the multiple-link file data protection feature activates first, removing the file, even though the -n option specifies "do not rename or unlink the file".[3] The -n option has been removed from the code and manual of srm version 1.2.11, the latest SourceForge.net version. As a consequence, this option/feature conflict does not occur.[2][6]

A number of file systems support file forks (called resource forks and named forks on OS X (particularly HFS+), and alternate data streams on NTFS), or extended attributes. However, OS X is the only platform on which srm securely deletes any of this additional data in files.[7] On OS X, only the most common non-data fork, the resource fork, is handled in this way.[3] This support was included in Apple’s srm 1.2.8 [5][8] and SourceForge's srm 1.2.9.[9]

srm was removed from OS X/macOS in v10.11 El Capitan, as part of the removal of the "Secure Empty Trash" feature for security reasons.[10]

In srm 1.2.11, released on 25 November 2010,[11] the OpenBSD rm-compatible option, -P, is documented have an overwriting pattern matching OpenBSD's rm.[2] Additional functionality which protects multi-linked files is documented under the OpenBSD-compatible option, but is actually always active.[2][3][4]

When securely deleting files recursively, srm 1.2.11 is unable to determine device boundaries on Windows. Therefore, the -x option, which restricts srm to one file system, is not supported.[2]