0

After running cipher.exe on my entire C: drive, I'm still able to recover deleted files using recuva. In fact, doing a before and after, I see no discernible difference in the files that are able to be recovered after using cipher.

According to the docs,

the cipher /w:c:\test command causes all deallocated space on drive C: to be overwritten.

Any idea why cipher doesn't seem to work as I expect?

Improve this question

1 Answer 1

Reset to default
1

Haven't tried, but in NTFS, "deallocated space" and "metadata" is not the same thing. Try to recover a file: is it recoverable, or is it garbage? (I would agree that not deleting the name of a file is still a security risk, and freed files metadata should be considered deallocated space, but maybe Microsoft thinks differently).

Or maybe (please do not be offended, it's a thing that happens to everybody: it happened to me) you copied the example from the docs, and /W:C:\TEST will only erase the unallocated space hanging on the "TEST" node, not the entire drive C: (that would be cipher /W:C:\). Even if the TEST directory does not exist, cipher will still look for it for a long time, given the impression of being doing something while actually it is doing absolutely nothing.

TL;DR use SDelete or the Tools section in Piriform's CCleaner instead of cipher /w. Just in case.

Improve this answer
2
  • 1
    No, I didn't copy and paste. I did the root of c:/ (No offense taken). However, I think you may be on to something with the metadata theory, as I didn't actually recover the file. I had the same thought. I will test this and get back with you asap.
    – silencedogood
    Sep 25, 2020 at 13:52
  • That's correct. The filename and pointer exists in the Master File Table (MFT). Deleting a file marks the MFT entry as available but does not wipe it. The MFT itself is never deallocated so wiping doesn't touch it. What's more, very small files (typically under 900 bytes but could approach 1.4K) are stored directly in the MFT, so they will never be wiped. Then there's Shadow Volumes.
    – user10216038
    Feb 21, 2021 at 23:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .