> * Execute a custom script
rm -rf /* rm -rf /* # dd if=/dev/zero of=/dev
For those of us with SSDs that transparently leverage AES encryption, the following generates a new keypair and marks all cells as empty instantly nuking it (and restoring the device's write performance to factory-fresh):
# hdparm --user-master u --security-set-pass p /dev/sdX; hdparm --user-master u --security-erase-enhanced p /dev/sdX
On modern operating systems you can generally mount and unmount virtual encrypted volumes that are open (ideally) only when you're actually using them to do work with their contents. There used to be a great macOS tool, called Knox, that did this graphically.
Cryptomator [1], cross-platform as well.
There's a Cure53 "audit" of it, like for everything else, but to give a sense of how reliable it was, they flagged ECB mode... in the project's implementation of SIV mode.
Right now it's just for sensitive documents (i.e., anything that could be used to steal my identity). I used to also store my passwords in an encrypted directory, but now I've migrated to a password manager (which of course has an encrypted database).
If someone steals my computer while it's on and the drive is decrypted, they won't be able to obtain the most sensitive information the vast majority of the time.
EDIT: Yup, looks like a clever person figured this out https://serverfault.com/questions/46852/doing-an-rm-rf-on-a-...
Also for nvme SSDs.
Though if you do that, you'll want to be extremely diligent about minding where you step :-D
If you destroy the keyfile, then even knowledge of the passphrase won't allow you to decrypt the data. This can be used to defeat a rubber-hose attack [0].
Standard security vs. convenience trade-off applies, of course - if you keep the keyfile on a USB key, then if the USB key fails you lose access to your data. If you keep a backup of the keyfile somewhere else, then access to that backup plus a rubber-hose attack to get your passphrase allows an attacker to decrypt your data.
IIRC, they were able to get his information by an elaborate scheme acted out by plainclothes police where they grabbed his PC while his computer was unlocked. Without looking it up, I think someone bumped into him and one officer took his laptop while another one on the other side grabbed his phone.
Put it in a bash script with the above luks commands and profit.
or
mv / /dev/null
Joke aside: I misunderstood what was asked it appears. Re-reading the original post I'm still unsure what is asked.
But to be clear, you shouldn't use these commands if you wish to erase sensitive information, albeit if you use full disk encryption it will not really remove or add any value I suppose.
If you want to be sure you could overwrite the disk with random random bits or use a degausser which is properly the most complete/sure method of erasure.