  We address the problem of secure data deletion on log-structured file
systems. We focus on the YAFFS file system, widely used on Android smartphones.
We show that these systems provide no temporal guarantees on data deletion and
that deleted data still persists for nearly 44 hours with average phone use and
indefinitely if the phone is not used after the deletion. Furthermore, we show
that file overwriting and encryption, methods commonly used for secure deletion
on block-structured file systems, do not ensure data deletion in log-structured
file systems.
  We propose three mechanisms for secure deletion on log-structured file
systems. Purging is a user-level mechanism that guarantees secure deletion at
the cost of negligible device wear. Ballooning is a user-level mechanism that
runs continuously and gives probabilistic improvements to secure deletion. Zero
overwriting is a kernel-level mechanism that guarantees immediate secure
deletion without device wear. We implement these mechanisms on Nexus One
smartphones and show that they succeed in secure deletion and neither
prohibitively reduce the longevity of the flash memory nor noticeably reduce
the device's battery lifetime. These techniques provide mobile phone users more
confidence that data they delete from their phones are indeed deleted.
