ZeroTrace

Summary

ZeroTrace overwrites a file, removes its name from the folder, and deletes it. It can also fill the free space on a drive, and clear copies of a name that are still in your history, thumbnails, and recent items.

A shred covers the copy the filesystem is using right now. Snapshots and the way solid-state drives wear can keep an older copy. A purge is different: the drive erases its own media, and the certificate says the disk was purged only after the drive reports that this erase finished.

Use cases

• A file or folder that should be destroyed, not dropped in the trash.
• Free space on an external drive that may still hold pieces of old files.
• A look at a path before you destroy anything.
• A file that is already gone, while its name is still in history or caches.
• A job you want finished by removing 0t itself.
• An external disk that should erase itself, and wait until the drive says that erase finished.

Download

The download saves the program in the folder you are in. On this computer that file is 0t, or 0t.exe on Windows. The script checks the file against SHA256SUMS before it keeps it. It does not change your PATH.

macOS and Linux:

curl -fsSL https://dl.arca.vision/0t | sh

Windows:

irm https://dl.arca.vision/0t.ps1 | iex

Download options

You can pin a version, ask for another kind of computer, or replace a file that is already in the folder.

--os is darwin, linux, or windows. --arch is amd64 or arm64.

Pin the current version, or fetch a Windows build from a Mac or Linux machine:

curl -fsSL https://dl.arca.vision/0t | sh -s -- --version 1.7.0
curl -fsSL https://dl.arca.vision/0t | sh -s -- --os windows --arch amd64

--force replaces a regular file that is already there:

curl -fsSL https://dl.arca.vision/0t | sh -s -- --force

The same choices on Windows:

$env:ZT_VERSION='1.7.0'; irm https://dl.arca.vision/0t.ps1 | iex
$env:ZT_OS='linux'; $env:ZT_ARCH='arm64'; irm https://dl.arca.vision/0t.ps1 | iex
$env:ZT_FORCE='1'; irm https://dl.arca.vision/0t.ps1 | iex

A file for this computer is saved as 0t or 0t.exe. A file for another computer is saved with the system and chip in the name, such as 0t-linux-arm64 or 0t-windows-amd64.exe.

Put it on your PATH

When the saved file is for this computer, the script prints how to move it. You run those steps yourself.

mkdir -p "$HOME/.local/bin"
mv ./0t "$HOME/.local/bin/0t"

If "$HOME/.local/bin" is not on PATH, add this to your shell startup file:

export PATH="$HOME/.local/bin:$PATH"

On Windows the saved file is 0t.exe. Copy it yourself:

New-Item -ItemType Directory -Force -Path "$env:LOCALAPPDATA\Programs\0t"
Move-Item -Force .\0t.exe "$env:LOCALAPPDATA\Programs\0t\0t.exe"

Add %LOCALAPPDATA%\Programs\0t to your user Path. The download does not change Path.

If your computer warns you

The file is unsigned. A browser download can trip Gatekeeper or SmartScreen. Defender may quarantine a shredder. curl does not set the browser mark.

On Windows

Run 0t.exe from PowerShell or Command Prompt, so the message stays on screen. Windows can refuse a file inside a folder you are allowed to open. 0t prints that refusal as Windows wrote it, and it stops at the first file. The rest of the folder stays as it was.

Check these four things before you shred a folder.

Controlled folder access. Open Windows Security, then Virus & threat protection, then Ransomware protection. When Controlled folder access is on, Windows blocks an unsigned program from changing Desktop, Documents, Pictures, Videos, and Music. 0t.exe is unsigned. The message is Access is denied. Allow 0t.exe on that screen, or turn Controlled folder access off for the run.

Read-only files. Read-only is a flag on the file. 0t has to write the file, and it does not clear the flag. Clear it for the folder:

attrib -R .\* /S /D

You can also clear Read-only in the file's Properties. The message is Access is denied.

A program still has the file open. Close Word, Excel, and photo preview. Pause OneDrive when the folder lives there. A lock is often The process cannot access the file because it is being used by another process. Some locks come back as Access is denied.

A name Windows will not open. Explorer can list a name that ends with a space or a period, a reserved name such as CON, NUL, or AUX, or a broken shortcut. Opening it fails. The message is The directory name is invalid. Folders copied from a Mac, a zip, or WSL often contain these names.

Try one file before a folder:

.\0t.exe shred .\secret.txt

The words in front of the Windows sentence name the step. metadata: is a warning about an extra data stream, and the shred continues. A line that is the path and Access is denied is the overwrite. remove or rename is the cleanup after the overwrite.

.\0t.exe inspect .\secret.txt describes a path and deletes nothing.

Current version

The current release is 1.7.0.

./0t version
./0t --version

version prints a short banner, a blank line, then the version. --version prints zerotrace and the version on one line.

On Windows, run .\0t.exe version.

Main features

• Shred overwrites a file or folder and deletes it. That is a Clear of the copy the filesystem is using. It does not follow shortcuts or symbolic links.
• Purge asks one whole external disk to crypto-erase itself, or to block-erase when the drive has no crypto-erase. It waits until the drive reports that this erase finished.
• Profiles choose how thoroughly the file is overwritten. modern is the default, with two passes. dod uses three. paranoid uses seven.
• ZeroTrace asks before it destroys anything. Add --yes when you already know the answer, including from a script.
• Run 0t with no arguments in a terminal and it opens a menu.
• Scrub free space fills the empty space on a volume, then releases it. It will not touch the drive the computer boots from.
• Inspect describes a path and deletes nothing.
• Sanitize clears a name from history, thumbnails, recent items, and the clipboard after the file is already gone.
• --melt removes this copy of 0t after a shred, including one you moved onto PATH. It leaves your shell startup file and the Windows user Path alone.
• Shred refuses system folders and the root of a drive. Free-space scrub refuses the boot volume.

A few commands

Destroy one file. ZeroTrace asks you to continue:

./0t shred ./secret.txt

Destroy the file, and also clear matching history, thumbnails, and the clipboard:

./0t shred ./secret.txt --clean-traces

Fill free space on an external drive, leaving 1 GB free:

./0t scrub-free /Volumes/ExternalSSD --reserve 1GB

Look at a path before you decide:

./0t inspect ./secret.txt

The file is already gone. Clear the name from this computer:

./0t sanitize --match secret.txt

Look at an external disk, then ask that disk to erase itself. ZeroTrace prints the serial and every volume on the physical disk. You type the serial before anything is erased. --yes on its own does not skip that check. Purge needs an administrator.

./0t inspect /Volumes/ExternalSSD
./0t purge /Volumes/ExternalSSD
./0t purge /Volumes/ExternalSSD --yes --serial SERIAL

Purge refuses the disk the computer is running from. On macOS the system does not return a sanitize status log, so the command stops and does not say the disk was purged. A USB adapter that hides the erase command fails the same way. Cancelling the wait does not tell the drive to stop. The drive may still be erasing, and the certificate says the run was interrupted.

Destroy the file, skip the question, and remove 0t when the run finishes:

./0t shred ./secret.txt --melt --yes

The same shred on Windows:

.\0t.exe shred .\secret.txt

./0t help lists every command. ./0t help shred lists the flags for one command.

What it cannot promise

A shred covers the space the filesystem hands it, the name in that folder, and the leftovers it can open on this computer. A purge certificate covers the drive's own report that its sanitize finished.

A snapshot, a clone, or the drive's own wear leveling can keep an older copy of a shredded file. Logs that already left this machine stay where they were sent. Data still in memory, and a hibernation image, are left alone. A purge does not remove a copy that was never on that disk.

The certificate names those leftovers under untouched. Swap, a hibernation image, a kernel audit log, and remote syslog are listed. A path inside iCloud, Dropbox, or OneDrive is listed as a cloud copy. A path inside a git work tree is listed as git objects. Listing them does not destroy them. Swap and the hibernation image stay on disk because overwriting either one can leave the machine unable to resume. --scrub-audit removes matching lines from a local text audit log and leaves the file in place. It runs only when you pass the flag and the process is an administrator. Remote syslog is still named untouched. On Windows, the kernel command line is named untouched when this process cannot overwrite it.

Signed certificates

Set ZT_SIGN_SECRET to an unencrypted minisign secret key and the certificate is signed. The signature covers the canonical JSON: the same certificate with signed false and no signature field. A run without that variable says signed no. The release checksum file is signed the same way. SHA256SUMS.minisig sits next to SHA256SUMS, and both installers check that signature before they trust the checksums. A missing or bad signature is a failed download. The public key is:

RWSiHOY414uTYzTJFvom6d9MhLUKZBREMWhjswpCy7yjFZ/VcVFfoppk

The secret key stays off this repository. Generate an unencrypted one with minisign -G -W. Apple notarization and Authenticode are not part of this release.

License

The download does not ask for an account. version, help, and inspect run without a license. shred, scrub-free, purge, and sanitize stop before they ask you to continue, and before they change a file, until a license file verifies. The check stays on this computer. ZeroTrace does not call a license server.

The file names the customer, the computer, and the last day it works. That day is included. After a download for this computer, 0t prints a code. Send that code to receive a license. 0t license prints the code again. The license works on that computer. A copy of the file on another computer is refused.

Put the file here, or set ZT_LICENSE to its path:

~/.config/0t/license.json

On Windows the file is %LOCALAPPDATA%\0t\license.json.

A missing file prints the code and exits. A bad signature, a code for another computer, or a date that has passed prints one line and exits. Nothing is changed.

The public key is built into 0t. The secret key that writes a license stays off this repository. It is a different key from the one that signs a download.

Operator policy

ZT_POLICY points at a JSON file. Leave the variable unset and every command behaves as it does today. If the file is missing or cannot be read, the command refuses.

{
  "allow_paths": ["/Volumes/ExternalSSD"],
  "allow_class": ["clear", "purge"],
  "allow_yes": false,
  "require_offline": false
}

A path outside allow_paths is refused, including a purge whose disk is outside those prefixes. A class that is not listed is refused. shred, scrub-free, and sanitize are class clear. allow_yes false refuses --yes. require_offline refuses the run when any non-loopback interface has a global address. An interface that is only up does not refuse the run. The certificate records the policy path and the checks that passed.