Shred files and folders
Overwrites the file's bytes with cryptographic random data, flushes it to the medium, then deletes. Logical, and honest about being logical.
Cinder — a wipe tool that says what wiping cannot do
It overwrites deleted files, free space and spare memory on an Android phone. Every app in this category promises more than the hardware can deliver. This one writes down the gap, in its own repository, where a user can read it.
Download the APK- Core
- Rust that touches no Android API, so it unit-tests on a laptop and cross-compiles to all four phone architectures
- App
- Java, running the wipe in a foreground service so it survives leaving the app
- Permissions
- Four — and internet access is not one of them
- Published
- Three pre-releases, downloadable without an account, every build debug-signed and labelled a dev preview
The claim every wipe tool makes, and why it is not quite true
On a spinning disk, writing over a file's bytes destroys them, because the bytes you asked to replace are the bytes on the platter. Phones do not work that way. Flash storage sits behind a translation layer that spreads writes across cells to stop any one wearing out, so a request to overwrite a file is free to be satisfied somewhere else entirely, leaving the original contents in a cell nothing points at any more.
That makes the headline feature of every secure-delete app on the store a best-effort operation rather than a guarantee, and no unprivileged app can do better. Cinder's answer is not to fix the impossible; it is to say so, in a document that ranks each of its three operations by what it actually promises.
Shred a file: logical overwrite of the bytes, best-effort on flash. The only hard guarantee: a factory reset. That table is in the repository, not the marketing.
What is provable is the opposite property
The dangerous operation is not deletion, it is filling free space: an app writing until a volume is full, on a device holding everything the owner cares about. So that is the property built to be provable rather than argued.
How the free-space wipe cannot touch an existing file
- 1
It never names one
The wipe creates a single subdirectory, opens that directory as a file descriptor, and creates every fill file inside it under plain integer names. It never builds a path to, or opens, any file that existed beforehand — so there is no window between checking a name and using it, and nothing it holds can escape the volume.
- 2
It stops before the device does
Before each write it re-reads the free space and stops at a margin, so it fills the disk without ever wedging the phone at zero bytes free.
- 3
It cleans up on the way out, including on failure
The scratch directory is removed whether the wipe succeeded or threw, and the app removes it again at launch, so a crash mid-fill leaves an empty directory rather than a full disk.
- 4
And then it is a test, not a paragraph
A test writes four known files, runs a bounded fill, and asserts all four are byte-for-byte identical afterwards and the scratch directory is gone. It is named for the claim it defends, and it runs with the rest.
$ cd rust && cargo test -p cinder-core proof_
running 3 tests
test tests::proof_deletion_overwrites_the_original_bytes ... ok
test tests::proof_fill_free_space_preserves_existing_files ... ok
test tests::proof_dirty_ram_leaves_other_data_intact ... ok
test result: ok. 3 passed; 0 failed; 13 filtered out
The audit is part of the product
Alongside the proofs is an audit that ranks the project's own open problems, worst first. The top entry is that the file-picker flow builds and is wired but has never been tapped through on a real device. The second is that the published APK is debug-signed, with the consequence spelled out: there is no in-place upgrade to a future signed build without uninstalling first.
Neither of those is flattering, and both are the first thing a reader finds. A security tool that hides its own untested paths is asking to be trusted on presentation, which is the one thing it should never be trusted on.
What it does
Fill free space
Overwrites the blocks freed by everything deleted before the app existed, without being able to touch a file that is still there.
Scrub spare memory
Claims the free memory pool, randomises it and hands it back, backing off rather than tripping the out-of-memory killer.
Free software
Read the proofs before you install it
The APK, the Rust core, the JNI bridge and the two documents that argue about what any of it guarantees are all in the one repository.
Cinder on GitHub