Myujth

After analyzing my Android application with a security tool, it has detected a high level vulnerability "File unsafe delete check". I have investigated about this, and it seems that the problem is that the application uses "file.delete()".

That function is considered unsafe because data could theoretically be retrieved with a tool that scans all the storage device. So, if that way of deleting is "unsafe"... what is the "safe" way to delete files in Android? (to avoid getting that "security error" that is supposedly a "high level" one). What is the proper way to delete files in Android Development?

I am getting the same security warning in 2 different applications, one made with native Java and the other one with Xamarin Forms. Thank you very much!

what is the "safe" way to delete files in Android?

There is none for the vast majority of Android devices. You use delete() on File.

That function is considered unsafe because data could theoretically be retrieved with a tool that scans all the storage device

If the Android device happens to use a classic hard drive (spinning magnetic media), you can overwrite the data before deleting it. On any sort of flash media, that will be ineffective, as the physical location where the data is written can vary with each write operation ("wear leveling").

So, this really boils down to your objective:

• If you feel that the user will be harmed if this data is available to be read, store it encrypted with a user-supplied passphrase.




• If you are simply trying to avoid this warning, ask the developers of this "security tool" what they are expecting you to do. Or, find a better tool.

This is not an Android specific issue.
It has to do with how file systems work, and the physical storage media it self.

When you delete a file, regardless of API, what is actually deleted is the record in the files table.

The actual data on disk or flash storage remains.

There is a method for secure deletion:
Before deleting the file, overwrite its contents with garbage or zeros several times.

But, this method only works for magnetic media such as hard disks.
Android devices use NAND flash for storage.

Because the number of writes a NAND chip can take before it fails is a lot less than that of magnetic memory, these chips usually come with a mechanism that spreads out the write commands.

What this means is that even if you try to write random data or zeros over your file, there is no guarantee the actual data will be overwritten.
The writes may go to a different sector to avoid wear.

So, on one hand, for flash storage it is enough to overwrite the file once, but on the other hand, it is impossible to do correctly at application level.

If you want to make your application secure, you must make sure to store sensitive data encrypted.
Then, even if someone tries to read the raw storage, they wouldn't be able to recover the data.

Don't store user credentials (like passwords) in regular files on Android.
Use Android accounts API and let the OS manage security.

If you still need file storage but want to protect the data, encrypt it in memory and then write to file.