Documentation

FileX Eraser for Business

One binary is both a desktop app and a CLI. Run it with no arguments to get the graphical app; pass flags to script it on servers and in CI. Erasure never requires a network, an account or a licence key.

Install

Download the archive for your platform from the download section, extract it, and put the binary somewhere on your PATH. Verify the SHA-256 against the published checksums.txt before you run it.

tar -xzf filex-eraser_linux_amd64.tar.gz
sudo install -m 0755 filex-eraser /usr/local/bin/
filex-eraser -version

Erasing (free)

--method=clear overwrites then deletes every file under the target path, and removes the emptied directories. This is the only method that erases anything; see whole-device methods below.

# See exactly what would be touched. Changes nothing.
filex-eraser --path ./payroll-exports --dry-run

# Erase, with the typed confirmation prompt.
filex-eraser --path ./payroll-exports --algo nist-clear

# Unattended, for scripts and CI.
filex-eraser --path ./payroll-exports --algo dod-3 --yes --json

Overwrite algorithms

Certifying (one credit)

Add --certify to have FileX counter-sign and archive the certificate. A credit is reserved before the erasure starts and committed only when the signed record comes back, so a crashed or cancelled job costs nothing.

export FILEX_TOKEN=fxk_live_...
filex-eraser --path ./payroll-exports --certify --yes

The token is resolved in this order, so CI and interactive use can differ:

1. --token <value>
2. $FILEX_TOKEN
3. ~/.filex/token

Issue and revoke tokens in the console. A token is shown once, at creation; revoking one takes effect immediately and does not invalidate certificates it already produced.

Offline behaviour

Erasure and local certificates work indefinitely with no network of any kind — there is nothing to phone home to. --certify requires a connection, because the counter-signature comes from a key held on our side. When the endpoint is unreachable the tool refuses and exits non-zero rather than silently producing a record that was never archived. That is deliberate: a certificate you believed was certified and was not is worse than an obvious failure.

Verifying

Verification is always free, always offline, and available to anyone — including people who have never bought anything from us.

filex-eraser verify filex-cert-a3f1c07e.json

It re-serialises the record canonically, re-hashes it with SHA-256, compares against the recorded value, and checks any ML-DSA-65 signatures present — the operator's own, and the FileX counter-signature. The same check runs in a browser at /verify.

Exit codes

Whole-device methods are advisory

--method=crypto-erase and --method=purge do not execute anything. They print the correct, vetted native command for your host (nvme sanitize, hdparm --security-erase, cryptsetup luksErase, and so on) and exit 5.

Issuing irreversible whole-device firmware commands from a broadly distributed binary is not something we are willing to do on your behalf, and we will not certify an erasure we did not perform. If your requirement is NIST 800-88 Purge with drive serial capture, this is the wrong product — Blancco, BitRaser Drive Eraser and KillDisk all do it properly.

Certificate format

A certificate is plain JSON tagged "spec": "filex-cert/1", alongside a self-contained printable HTML report that embeds the same JSON. The integrity hash is SHA-256 over a canonical serialisation — recursively sorted keys, compact JSON — of the record with the hash and signature fields removed.

Three fields sit outside the hash preimage, because each of them signs that hash and including them would be circular:

• integritySha256 — the hash itself.
• signature — optional ML-DSA-65 signature by the operator's FileX ID, context FileX-cert-sig-v1.
• countersignature — added by FileX on certify, context FileX-cert-countersign-v1.

The two contexts are domain-separated, so a signature of one kind can never be presented as the other. Two independent implementations — the browser and the Go CLI — produce byte-identical hashes, and both are tested against the same committed fixture.

What we store when you certify

Never file contents, and never file bytes. Erasing without --certify transmits nothing at all. When you do certify, what leaves the machine is certificate metadata:

Named mode is off by default and can only be enabled by an organisation admin in the console. When it is on, every certificate issued says so on its face, so nobody can be surprised after the fact by what a certificate reveals.

This is a deliberate, documented exception to FileX's usual rule that nothing leaves the device — the same treatment FileX Send gets. It is scoped to the metadata above, it happens only when you explicitly pass --certify, and it is described in full in the project's own design freeze.

Guardrails

The tool refuses to erase system and root paths, and requires you to type ERASE before a destructive run unless --yes is given. --force-dangerous overrides the path guard; it exists for deliberate server use and should be treated as a loaded weapon.