How sufficient are these steps to prevent deleted SSD files from being recovered?

Question

I'm selling a 4-year-old Dell PC with Windows 10 and two SSDs and I want to be sure that nobody can recover anything from my personal deleted files. So far I've done the following.

1. Completely Bitlocker encrypt both disks, including unused space. (Note the machine did not have TPM so I had to use a password)
2. Uninstalled software and deleted all personal files. (For sake of discussion, let's assume I didn't miss any personal files.)
3. Created a new, Administrator-level account
4. Logged on to the new account.
5. Completely deleted my previous user account.
6. Completely Bitlocker DE-crypted both disks again
7. Completely bitlocker encrypted and then decrypted both disks, yet again.

My idea was that if Bitlocker full-disk encryption/decryption really touches the whole disk, then two rounds of encrypt/decrypt out to overwrite everything. But I don't know if I understandit correctly or even if SSDs truly work like HDDs in that regard

Is this good enough? Is there some other step I can take that doesn't involve buying some expensive tool?

I can't sell this encrypted and I want to leave Windows 10 on there so I didn't want to completely reformat the system drive.

Answer 1

Either you're serious about deleting your data, or your serious about keeping your system functional as it were. The distinction between user data and operating system state is kind of weak, especially on Windows' questionable ecosystem with myriads of third-party things that shouldn't be a system service, but are.

You'd want to enable hardware disk encryption, then wipe that password, leading to the SSD safely discarding all data (or ways to decrypt it).

You'd lose your running Windows.

Honestly, when buying a used computer, first step, wipe the SSD and re-install the operating system from clean slate. Have no interest in continuing to run the malware that the previous owner (most likely involuntarily) ran.

So, a "already working" Windows 10 installation adds exactly nothing to the worth of a laptop to me. A Windows License, however, might. So, clearly mark that you're selling the laptop with a windows 10 license, and deliver it with the product key (which, afaik, you can somehow extract from your running windows). You can pre-install Windows if you want, up to the point where it starts asking for customization.

Answer 2

How about copying massive volumes of junk data into the drives and then doing the same procedure all over again? Overwriting can hide your data (even if it is recoverable by any means).

Answer 3

Briefly: No, these steps are not sufficient.

I would split it into 2 parts.

1. Preventing deleted files from being recovered.

Use wiping tools. There are many there, free and commercial. If I recommend you particular tools, the post can be flagged as opinion based. Just google for "Windows wipe free space". The most of the such tools create one or more temporary files and fill them with random data until the whole free space is used, i.e. until the disk is full. Then the tools delete these files. This can take long, depending on how much free space you have on your SDD. If you had classified data on your disk and if your buyer is some powerful state agency, you can repeat wiping 3-5 times. Otherwise single wiping is sufficient.

2. Deleting personal data. (which is actually not the direct question, but since the author described it in details, I consider it also relevant)

If you keep Windows installed on your disk, there is no guarantee that you deleted all sensitive information. Pay attention to the following:

1. There can be information placed under Users\Public, which may be sensitive from your point of view.
2. There can be some other user account that were created when you installed some software. E.g. when installing some databases or some web servers, a default user accounts can be created to run this software as a service.
3. Many uninstallers work incorrectly, delete only the executable files, but leave come configuration files and, much worse, leave information on many different places in Windows registry: Not only below "Software" branch in the registry, but in many other places.
4. Some of your personal information can be stored under the system branches in the registry, not only unter your users branch. E.g. passwords for some software that you installed in the mode "available to all users" mode instead of restricting to your user only.
5. There can be sensitive data in directories outside of your home directory.