2

So in windows CMD, there is the Cipher.exe Command Line tool. Supposedly it will allow you to fully overwrite empty disk space with 0x00 and 0xFF. (with the /w parameter)

There is some further information here which I could find about the usage of the command.

From my understanding this should mean that any data deleted should be unrecoverable.

I could not find too much information on to what extent is this true and can it be relied on to securely delete data permanently?

  • Who are you worried about trying to recover the data? Are we talking basic snooping by an annoying brother, somebody with some technical skills, or a state-actor? – DarkMatter Mar 27 at 19:29
  • @DarkMatter It's entirely theoretical, I'm just interested. Would it have an effect on someone with technical skills? – Kyle Wardle Mar 27 at 19:55
  • 2
    Basic technical means of recovering the data would be thwarted by zeroing the unallocated disk space (please note that cipher.exe /w:folder will only overwrite data that is not allocated to files or folders on the volume specified). There are more advanced techniques which involve looking at physical characteristics of the non volatile memory("hard drive"). These physical characteristics can persist after a zeroing. – DarkMatter Mar 27 at 20:03
  • This entirely depends on whether you are using a hard drive, a solid state drive, or a hybrid drive, as well as whether or not you have shadow volumes enabled. – forest Mar 28 at 0:43
  • @DarkMatter Those "physical characteristics" have not been found on any modern drives. They were theorized about back when MFM drives were a thing, but nowadays it isn't believed that any recoverable data remains. Any sector which is overwritten will have the existing data on it completely destroyed. – forest Mar 28 at 0:44
3

Securely deleting data, otherwise known as “wiping” can be surprisingly difficult.

Overwriting data even once with “cipher.exe”, or any other tool, makes the data effectively gone. The old bugaboos about multiple pass wipes being necessary to thwart magnetic force microscope recovery of partial track wipes is urban legend. It was theoretically possible back in the days (20 years ago) preceding IDE disk drives with storage capacities measured in MEGAbytes. Even then it was a laboratory curiosity never successfully demonstrated at scales beyond a few bytes. A one pass write of anything; zeroes, random, pattern, whatever, securely wipes the data. Yes, “cipher.exe” and others offer multiple pass wiping, but this is a marketing holdover because so many people still believe it’s necessary. It’s not and it’s a waste of time, but feel free to multipass if you like.

But I said it can be difficult, then described something simple?

The hard part is actually overwriting the data, because the data is often not as static as it seems.

Tools like “cipher.exe” overwrite unallocated disk space, commonly referred to as deleted. For the most part, this works as you would think.

So where does this fail?

Slack Space (smallish risk)

File storage is allocated in blocks. Any file that does not use an exact multiple of blocks will have filler making up the difference. Typically this is fragments of whatever file last used this disk block. Realistically, this is a relatively low risk of useful content. On solid state drives with properly functioning TRIM, slack space should be empty.

Bad Tracks/Sectors (small risk)

Tracks that have been remapped due to failures may contain chunks of data that will not be touched by overwrite attempts. Generally these are genuinely bad and data is not retrievable, or even if retrieved contains system fragments not associated with anything important. Yes bad tracks can be artificially created, but if you did that you’d know you did it, it’s not accidental.

Load Leveling (insignificant risk)

Solid state drives attempt to reduce wear by switching out memory chunks internally. When this happens, old data cannot be reached to overwrite it. Again, these are tiny chunks and accessing the chunks requires “Chip-Off”, removing the memory chips and controllers in order to bypass the wear leveling control. Even if this is done, good luck getting anything useful from it.

Databases and MFT (significant risk)

Databases delete entries by marking the space as available to be reused, however this is not unallocated to the system because it’s still part of the allocated database file. It will not be overwritten by “cipher.exe”. The Windows Master File Table works in an analogous manner. It’s main function is to hold file attributes and point to the disk location(s) actually containing the file data. However if a file is small enough (approaching up to 981 bytes), the actual file data may be stored directly in the MFT. Deleting this file marks the entry as available to the MFT, but the MFT as a whole is still allocated so will not be touched by “cipher.exe”.

Shadow Volumes (big risk)

Microsoft supports the ability to perform recovery “rollbacks”. It accomplishes this feat of magic with the Volume Shadow Service (VSS). In essence, Windows maintains prior version copies of files that have changed. Not just a single previous version, but potentially many previous versions. These previous version files are easily recoverable even if the current version has been successfully wiped. “cipher.exe” will not touch shadow volumes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.