0

After running cipher.exe on my entire C: drive, I'm still able to recover deleted files using recuva. In fact, doing a before and after, I see no discernible difference in the files that are able to be recovered after using cipher.

According to the docs,

the cipher /w:c:\test command causes all deallocated space on drive C: to be overwritten.

Any idea why cipher doesn't seem to work as I expect?

1

Haven't tried, but in NTFS, "deallocated space" and "metadata" is not the same thing. Try to recover a file: is it recoverable, or is it garbage? (I would agree that not deleting the name of a file is still a security risk, and freed files metadata should be considered deallocated space, but maybe Microsoft thinks differently).

Or maybe (please do not be offended, it's a thing that happens to everybody: it happened to me) you copied the example from the docs, and /W:C:\TEST will only erase the unallocated space hanging on the "TEST" node, not the entire drive C: (that would be cipher /W:C:\). Even if the TEST directory does not exist, cipher will still look for it for a long time, given the impression of being doing something while actually it is doing absolutely nothing.

TL;DR use SDelete or the Tools section in Piriform's CCleaner instead of cipher /w. Just in case.

2
  • 1
    No, I didn't copy and paste. I did the root of c:/ (No offense taken). However, I think you may be on to something with the metadata theory, as I didn't actually recover the file. I had the same thought. I will test this and get back with you asap. – silencedogood Sep 25 '20 at 13:52
  • That's correct. The filename and pointer exists in the Master File Table (MFT). Deleting a file marks the MFT entry as available but does not wipe it. The MFT itself is never deallocated so wiping doesn't touch it. What's more, very small files (typically under 900 bytes but could approach 1.4K) are stored directly in the MFT, so they will never be wiped. Then there's Shadow Volumes. – user10216038 Feb 21 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.