As we all know, when we delete files or folders in Windows, the data is not completely removed from the hard disk. Instead, the space on the hard drive that was occupied by the deleted data is just being deallocated and marked as “available to use” for new data to write in. Until the space is re-written, it’s possible to recover these deleted data by using many data recovery tools out there.
Usually, you will need a 3rd party data wiping tool to do the wiping job to ensure the deleted data is indeed deleted and cannot be recovered. But do you also know that Windows have a tool built-in that can accomplish the same?
It’s a command line called Cipher designed primarily for encrypting/decrypting data on the drives that use NTFS file system, using EFS, Encrypting File System.
Use /w switch with the cipher command, you can overwrite deleted data in a specific folder on a specific volume. For example, if I want to wipe clean the deleted space in my download folder which was set in z:\downloads, I can just run the following command.
Once done, the deleted data in my downloads folder will be overwritten and wiped out completely clean.
I need to point it out that running /w with cipher will not delete any active data. It only overwrites the deleted space so any data recovering tools can not recover them.
Sounds cool? It’s actually nothing new. The Cipher security tool has been around since Windows 2000 and got enhanced over the years with each Windows releases. I will take a deep look what it can do and may share some more tips later on.