Forensicsfilesystemext2ext3ext4disk-imagezero-free-blocks

zerofree

Zerofree finds unallocated blocks with non-zero content in ext2, ext3, and ext4 file-systems and fills them with zeroes. This is particularly useful for reducing the size of disk images in virtual machines.

Description

Zerofree is designed to zero out unallocated blocks in ext2, ext3, and ext4 file-systems that contain non-zero data. This tool is primarily useful when working with disk images, as it allows secondary utilities to shrink the image size after zerofree has cleared the unused space. The file-system must be unmounted or mounted read-only for zerofree to operate.

Unlike the traditional method of using 'dd' to create a zero-filled file that consumes all free space before deletion, zerofree avoids several issues: it doesn't temporarily expand the disk image to maximum size, doesn't exhaust free space (preventing concurrent writes), and is significantly faster. It was specifically written for GNU/Linux guest OSes in virtual machines, though it can also securely erase sensitive data better than a simple 'rm'.

Zerofree requires minimal dependencies and has a small installed size of 30 KB.

How It Works

Zerofree scans the specified ext2, ext3, or ext4 filesystem for unallocated blocks containing non-zero data and overwrites them with zeroes (or a specified fill value). It operates directly on the filesystem structure without requiring the filesystem to be mounted writable, targeting only unused blocks to reclaim space in disk images for subsequent compression by virtualization tools.

Installation

bash
sudo apt install zerofree

Flags

-nDry run - show what would be done without making changes
-vVerbose output
-f fillvalFill blocks with value fillval instead of zeroes

Examples

Zero free blocks on the ext2/ext3/ext4 filesystem at /dev/sda1 (filesystem must be unmounted or read-only)
zerofree /dev/sda1
Dry run: preview which blocks would be zeroed on /dev/sda1 without changes
zerofree -n /dev/sda1
Zero free blocks on /dev/sda1 with verbose output
zerofree -v /dev/sda1
Fill free blocks with 0xFF instead of zeroes on /dev/sda1
zerofree -f 0xFF /dev/sda1
Dry run with verbose output on /dev/sda1
zerofree -nv /dev/sda1
Verbose zeroing of free blocks with custom fill value 0x55 on /dev/sda1
zerofree -vf 0x55 /dev/sda1
Zero free blocks on a loop-mounted filesystem image
zerofree /dev/loop0
Updated 2026-04-16kali.org ↗