Ashes

Free-space wiper and file shredder for Android that cannot touch a file you did not choose. Twelve sanitisation standards (NIST 800-88, HMG IS5, DoD 5220.22-M, Gutmann and more), verified overwrites, no network permission. Deleted stays deleted.

Deleted stays deleted.

A free-space shredder and file shredder for Android, built so that it cannot touch a file you did not choose.

✨ What Ashes does When you delete a photo, a document or a message attachment, Android only forgets where it was. The bytes stay on the flash until something else happens to land on top of them, and recovery tools know exactly where to look. Ashes lands on top of them, on purpose.

🧹 Wipe free space. Ashes fills the free space of a volume with pattern files until the device reports it is full, rewrites those files in place for every further pass, verifies the last pass by reading it back, and deletes them. Every block that used to hold deleted data now holds the pattern. 📄 Shred specific files. Pick files in the system file picker. Each one is overwritten in place for every pass, verified, emptied, renamed twice so the original name leaves the directory, and deleted. 🧪 Twelve sanitisation standards, as data. NIST SP 800-88 Clear, HMG Infosec Standard 5, DoD 5220.22-M, Bruce Schneier's 7-pass, BSI VSITR, RCMP TSSIT OPS-II, AFSSI-5020, GOST R 50739-95 and Peter Gutmann's 35-pass, with four quick picks: 1, 3, 7 and 35 passes. ✅ Verified overwrites. Random passes come from a keyed AES-CTR stream with a key per pass and a nonce per file, so the final pass is regenerated and compared byte for byte without storing a single byte of it. 🛡️ Structurally unable to delete your files. One deletion path in the whole engine, guarded three ways. Details below. 🌡️ Knows the phone. Battery and temperature checks before it starts, pauses on severe thermal throttling, keeps the CPU awake through a foreground service, and gives the space back on cancel, crash, reboot or update. 🔌 No network permission. The manifest declares none, so the operating system itself guarantees that nothing leaves the device. 🌗 Norypt design, light and dark. The norypt.com palette by day, the Norypt app palette by night.

🛡️ Why it cannot delete your files Most "secure delete" tools ask you to trust them. Ashes is built so that trust is not required.

Single write root. The free-space engine receives one directory that it created itself, inside the app's private storage on the target volume. Every path it touches is derived from that root. No enumeration outside the root. The engine has no code that lists, opens or deletes anything anywhere else. Its storage interface is deliberately tiny, and a build-time test fails if any Android API leaks into it. Three-factor ownership before every delete. A file is deleted only if its canonical parent is the workspace (symlinks resolve to their targets and fail), its name is one of ours, and its 64-byte header carries this job's id. One deletion path. The same sweeper serves the normal release, cancellation, failure and crash recovery. There is nothing else in the product that deletes. Tested the hard way. The engine runs on a JVM against an in-memory block device whose free blocks are stained with a marker. After every scenario, including simulated process death at every phase followed by recovery, the tests require that every user file is byte-for-byte unchanged, free space is exactly restored, and no formerly free block still carries the marker. The shredder is held to the same rule: it acts only on documents the picker handed it, and it cannot browse.

🧪 Methods Standard Passes Patterns Verification NIST SP 800-88 Rev. 1, Clear (recommended) 1 random required Single pass, zeros 1 00 optional HMG Infosec Standard 5, Baseline 1 00 required HMG Infosec Standard 5, Enhanced 3 00 · FF · random required DoD 5220.22-M (E) 3 00 · FF · random required DoD 5220.22-M (ECE) 7 00 · FF · random · 96 · 00 · FF · random required US Air Force AFSSI-5020 3 00 · FF · random required Bruce Schneier 7 FF · 00 · random × 5 optional German BSI VSITR 7 00 · FF · 00 · FF · 00 · FF · AA optional Canadian RCMP TSSIT OPS-II 7 00 · FF · 00 · FF · 00 · FF · random optional Russian GOST R 50739-95 2 00 · random optional Peter Gutmann 35 the published 1996 table none specified Before you commit, the app shows the estimated time and the share of rated flash life the run will spend on the free area, per method.

🔬 What it honestly cannot do Phones use flash memory behind a controller that remaps blocks for wear levelling. Overwriting a logical block does not guarantee the old physical cells were rewritten; that happens when Android issues TRIM during idle maintenance and the controller garbage-collects. So:

Multi-pass schemes designed for magnetic disks add wear and time on flash, not security. They are offered because standards and customers ask for them by name, and the app says so next to each one. The recommended method is one verified random pass. Cells the controller has retired, other apps' private caches and cloud copies are outside what any app can reach. For a phone you are giving away, use a factory reset, which destroys the encryption keys. On copy-on-write filesystems (F2FS on most modern phones) an in-place rewrite of a single file may land in new blocks. Ashes tells you when that applies and offers a free-space pass right after a shred.

License

GPL-3.0