Documentation

FileX erasure products

Three desktop applications, one certificate format. They share an installer-free binary, an evidence layer and a console; they differ in what they are allowed to claim about the erasure. Every one requires an activated licence before it will destroy anything.

The three applications

Install

Download the archive for your platform from its product page and extract it. Each product publishes its own SHA-256 checksum file — verify against the one linked from that product’s page, not another’s. There is nothing to install beyond the single file — no service, no driver, no agent.

tar -xzf filex-eraser-business_linux_amd64.tar.gz
sha256sum -c checksums-business.txt --ignore-missing
./filex-eraser-business

Running it with no arguments opens the app. On Windows and macOS you can double-click it from a file manager and get the same window; Linux packages ship a .desktop entry. -version prints the build and exits, which is the only thing any of these binaries does without opening a window.

Builds are published for x64 and ARM64 on each supported platform. Drive Purge has no macOS build, for the reason given under whole-drive sanitize. The archive for the FileX (non-business) edition is named filex-eraser_… and is served from files.cybxsan.com instead.

Licensing and activation

A licence is required to erase. Open Licence, paste the key from your order or the console, and press Activate. The application contacts FileX once, sends the licence key and a machine fingerprint — and nothing else — and stores the signed entitlement it gets back. From then on it runs offline for the remainder of the term.

Keys bought online are issued and emailed by Dodo Payments, our merchant of record, which also enforces how many machines a key covers — so FileX passes Dodo the licence key and a short identifier derived from the fingerprint when you activate. To move a seat to another machine, release it in the console first.

This is a change from earlier versions, which erased without any licence check. It is stated here, on the pricing page and in the privacy policy rather than left to be discovered in a packet capture. No file name, path or byte is sent at activation or at any other time.

Air-gapped sites. Choose Activate offline and the app writes a request file. Upload it in the console from any connected machine, download the response, and load it back. The installation then never makes a network call of any kind — which also means it cannot counter-sign, so its certificates are self-signed and verifiable on their own hash and operator signature.

What a licence covers. The file erasers are licensed per endpoint per year, and a licensed endpoint may perform unlimited erasures and obtain unlimited counter-signed certificates. Drive Purge is licensed per drive sanitized, from a pack that does not expire, and a drive is consumed only when a sanitize is confirmed and its certificate archived.

Erasing files and folders

Open Erase, choose a folder, and the app overwrites then deletes every file beneath it and removes the emptied directories. On a licensed endpoint this is unlimited and needs no network. It erases what you select — for a volume’s free space see free-space wipe, and for a whole drive see whole-drive sanitize.

1. Choose folder… opens your operating system's own folder dialog. On a headless machine — a server, a container — the app shows a built-in folder browser instead, because that is exactly where this tool tends to run.
2. Preview what would be erased lists every file and the total size, and touches nothing. Use it — it is the last chance to notice a wrong folder.
3. Pick an overwrite method, then Erase now and confirm the dialog.

When it finishes you get the certificate ID, the integrity hash and the path both copies were written to: a printable HTML report and the signed JSON next to the folder you erased.

Overwrite methods

More passes is not more secure on modern media, and the default says so. The longer methods exist because procurement documents and tenders ask for them by name.

Counter-signing a certificate

Tick Counter-sign this certificate before erasing and FileX signs the finished record with a key you do not hold, then archives it at a permanent verification URL. That is the difference between a document you produced about yourself and evidence a third party can check.

On a licensed endpoint, counter-signing is unlimited and costs nothing per job. What the app checks before starting is that it can actually reach the archive: if the endpoint is unreachable, the token unknown, or the licence inactive, it stops and erases nothing rather than destroying data it cannot evidence.

Drive Purge is the exception, because it is metered per drive. It confirms a drive is available from the pack before the sanitize begins, and consumes it only once the drive has confirmed completion and the certificate has been archived. A sanitize that is refused, fails, or cannot be confirmed consumes nothing — and produces no certificate.

Connecting your organisation

Open Organisation, paste an organisation token, and press Connect. The app stores it in ~/.filex/token with owner-only permissions and remembers it between runs; it is masked from then on and never redisplayed. Disconnect deletes the file.

The token is resolved in this order, so an image built for a fleet can supply one centrally:

1. The token saved in the app
2. $FILEX_TOKEN
3. ~/.filex/token

Issue and revoke tokens in the console. A token is shown once, at creation; revoking one takes effect immediately and does not invalidate certificates it has already produced.

Once connected, the app's header shows the organisation name and the licence status — and, for Drive Purge, the drives remaining — at all times, and Certificates lists everything the organisation has archived, so an operator standing at a machine in a rack can see the job they just ran without finding a browser to sign in with.

Offline behaviour

After activation, erasing files and producing local certificates work indefinitely with no network of any kind — there is no telemetry, no usage counter and nothing to phone home to. Only three operations use the network, all of them initiated by the operator: activating the licence, once; counter-signing a certificate, because the counter-signature comes from a key held on our side; and, in FileX Drive Purge only, counting each drive against your pack — reserved before the sanitize, charged only when it is confirmed (see what that sends). Drive Purge will not sanitize a drive it cannot count. When the archive endpoint is unreachable the app refuses and erases nothing rather than silently producing a record that was never archived. That is deliberate: a certificate you believed was certified and was not is worse than an obvious failure.

Verifying

Verification is always free, always offline, and available to anyone — including people who have never bought anything from us.

Open Verify and choose the certificate's .json file. The app re-serialises the record canonically, re-hashes it with SHA-256, compares against the recorded value, and checks any ML-DSA-65 signatures present — the operator's own, and the FileX counter-signature. Because the public key travels inside the certificate, none of this contacts us; an auditor with the file and this app needs nothing else, and needs to trust nothing else either.

The same check runs in a browser at /verify, which is the link to send someone who has the certificate but not the app.

Three outcomes are reported separately, because they mean different things: the integrity hash tells you the record has not been altered since issue; the operator signature tells you which FileX ID produced it; the FileX counter-signature is the only part the certificate holder could not have produced themselves. A certificate with a valid hash and no counter-signature is internally consistent and attests only to itself, and the app says exactly that rather than showing a green tick.

Free-space wipe and TRIM (FileX SSD Eraser)

Deleting a file yesterday left its contents in unallocated space. FileX SSD Eraser can overwrite that space and then ask the drive to release it, which is the closest a file-level tool gets to reaching earlier deletions.

Before it erases anything it reports what the target actually is: flash or rotational, and whether the volume is encrypted at rest (BitLocker, FileVault, LUKS). That second fact is what makes a deletion defensible on flash — residue left in stale cells on an encrypted volume is ciphertext. Both are recorded in the certificate, because "deleted from an encrypted volume, TRIM issued" and "deleted from a plaintext volume" are different evidentiary positions.

The wipe fills free space in chunks, stops short of filling the volume, deletes what it wrote, and issues a TRIM (FITRIM on Linux, Optimize-Volume -ReTrim on Windows). It refuses network shares, read-only mounts and the boot/system volume.

Whole-drive sanitize (FileX Drive Purge)

Drive Purge does not overwrite. It issues the drive’s own firmware sanitize command — nvme sanitize (crypto or block erase) or ATA Secure Erase on Linux, the Windows storage-sanitize IOCTL on Windows — and the drive’s controller does the work, including the regions no host command can address. That is what makes it NIST 800-88 Purge rather than Clear.

It will only run when every condition holds, and any probe error makes a drive ineligible:

• The drive is external and removable, and is not the boot or system disk.
• No filesystem anywhere on it is mounted, and it is not the disk the application itself is running from.
• You are running with administrator or root rights. The app never self-elevates — it shows the device list read-only and prints the relaunch command instead.
• You have typed the drive’s serial number, read from the physical label, and it matches. USB-to-SATA bridges report a disk in a dock as external, so the serial is the check that matters.

A firmware sanitize cannot be cancelled. Cancel is honoured while the job is queued; once the drive accepts the command, cancelling only detaches the interface.

No macOS build, and no boot drives. macOS provides no path to pass a sanitize command through a USB or Thunderbolt bridge, so there is nothing honest to ship there. Sanitizing the disk a machine is running from requires booting another operating system first; Drive Purge does not do that today, which is why its scope is external drives.

Certificate format

A certificate is plain JSON tagged "spec": "filex-cert/1", alongside a self-contained printable HTML report that embeds the same JSON. The integrity hash is SHA-256 over a canonical serialisation — recursively sorted keys, compact JSON — of the record with the hash and signature fields removed.

Three fields sit outside the hash preimage, because each of them signs that hash and including them would be circular:

• integritySha256 — the hash itself.
• signature — optional ML-DSA-65 signature by the operator's FileX ID, context FileX-cert-sig-v1.
• countersignature — added by FileX on certify, context FileX-cert-countersign-v1.

The two contexts are domain-separated, so a signature of one kind can never be presented as the other. Two independent implementations — the browser and the Go app — produce byte-identical hashes, and both are tested against the same committed fixture.

What we store when you certify

Never file contents, and never file bytes. Erasing without counter-signing transmits nothing at all once the licence is activated. When you do counter-sign, what leaves the machine is certificate metadata:

Named mode is off by default and can only be enabled by an organisation admin in the console. When it is on, every certificate issued says so on its face, so nobody can be surprised after the fact by what a certificate reveals. The app shows the mode your organisation is in under Organisation, and the server re-checks the certificate's actual contents on arrival rather than trusting what the app declares.

This is a deliberate, documented exception to FileX's usual rule that nothing leaves the device — the same treatment FileX Send gets. It is scoped to the metadata above, it happens only when you explicitly ask for a counter-signature, and it is described in full in the project's own design freeze.

Guardrails

• The app refuses to erase system and root paths outright.
• Nothing is destroyed without a preview available first and an explicit confirmation dialog naming the folder and the method.
• Symbolic links are unlinked, never followed — a link into a directory you did not select cannot pull its target into the wipe.
• Files that cannot be erased (in use, permission denied) are recorded on the certificate as failed rather than quietly omitted, so the count on the certificate is the truth about what happened.
• The app's own local API is bound to 127.0.0.1 on a random port behind a per-run token, so no other process and no web page you have open can drive an erasure.