Devices Overwrite Deleted Data on Drive in Windows 11 and 10

Awesome, assuming this doesn't affect existing data on the disk.

Scott said:

Awesome, assuming this doesn't affect existing data on the disk.

Click to expand...

Hello Scott,

It doesn't. Only deleted data.

This is great - only took about 5 minutes on my nvme C drive partition (250 GB).

Funnily enough only took same on my E drive partition (750 GB).

As far as I can tell this only works with allocated partition with a drive letter.
I am presuming if you deleted a partition before running cipher, you would have to create one in unallocated space, format as NTFS (or whatever), run cipher and then delete partition (if you wanted to).

cereberus said:

This is great - only took about 5 minutes on my nvme C drive partition (250 GB).

Funnily enough only took same on my E drive partition (750 GB).

As far as I can tell this only works with allocated partition with a drive letter.
I am presuming if you deleted a partition before running cipher, you would have to create one in unallocated space, format as NTFS (or whatever), run cipher and then delete partition (if you wanted to).

Click to expand...

It works on any drive with a drive letter. It secure erases any free space on the drive to make any deleted data unrecoverable.

Confused on my part:
1) Ran the command via power shell (admin) on ADATA SU635 SSD 226 GB, it ran for 3 hours and I only got one whole line of dots across the screen. Then in lower right hand of system tray, a notification popped up saying "Your Disk is almost out of space, Storage Sense is trying to free up space". I immediately rebooted the system and all was back to normal. But it was obvious the command did not fully complete through. Should I have let the system continue despite seeing that popup??

2) Running the command via power shell (admin) on a different system with a Samsung SSD 840 GB EVO 500GB , it now has run for almost an hour. First I saw it run using 0x00 and the once that stopped, it started again with 0xFF. Everything surely different then when I did the ADATA SU635.

So my questions are:
A) Should I have allowed the process to continue despite seeing that notification popup when doing the ADATA SU635.

B) Is the process described for the Samsung SSD 840 GB EVO 500GB normal. I ask because of the two different overwrite patterns it is executing and the time it's taking (almost an hour and still running?

Stupsi said:

Confused on my part:
1) Ran the command via power shell (admin) on ADATA SU635 SSD 226 GB, it ran for 3 hours and I only got one whole line of dots across the screen. Then in lower right hand of system tray, a notification popped up saying "Your Disk is almost out of space, Storage Sense is trying to free up space". I immediately rebooted the system and all was back to normal. But it was obvious the command did not fully complete through. Should I have let the system continue despite seeing that popup??

2) Running the command via power shell (admin) on a different system with a Samsung SSD 840 GB EVO 500GB , it now has run for almost an hour. First I saw it run using 0x00 and the once that stopped, it started again with 0xFF. Everything surely different then when I did the ADATA SU635.

So my questions are:
A) Should I have allowed the process to continue despite seeing that notification popup when doing the ADATA SU635.

B) Is the process described for the Samsung SSD 840 GB EVO 500GB normal. I ask because of the two different overwrite patterns it is executing and the time it's taking (almost an hour and still running?

Click to expand...

Hello mate,

I wouldn't run this command on an SSD/NVMe unless you plan on selling or trashing it since it adds more wear and tear on it.

A) The low disk space may have caused an issue. I would free up more space before running the command again.

B) It can indeed take several hours. The larger the drive the longer it takes to finish.

OOP"S -- OOP'S---THANKS BRINK
Very glad I checked with you--immediately stopped the processes and rebooted both systems. I haven't noticed anything wrong yet
but will run a few diagnostic's to make sure.

Stupsi said:

OOP"S -- OOP'S---THANKS BRINK
Very glad I checked with you--immediately stopped the processes and rebooted both systems. I haven't noticed anything wrong yet
but will run a few diagnostic's to make sure.

Click to expand...

No worries. It doesn't hurt anything to interrupt the overwrite.

The tutorial should clearly differentiate between HDDs and SSDs to avoid misleading users.

For SSDs, simply overwriting data blocks may not be sufficient due to the way data storage is managed internally by SSDs.

To make it easier for me to include formatting and pictures, I have attached a PDF file of background info that leads to my question about what Cipher is doing and why it takes so long.

My thanks for your time.

pdc

I did some more testing and digging around for information. The following is what I came to find in no priority order.

1. If I open a CMD window and put the command 'cipher /W' where D: is the USB memory stick, have the Windows Task Manager utility running for the D drive and press Enter in the CMD window, I get a string of '*' and then nothing. Looking at Task Manager, I see a bunch of write operations and then nothing but read operations. For hours.

2. The test I did yesterday with that exact same command line ran 7 hours of all read operations. This is against a 500MB USB memory stick.

3. When I terminated the CMD window that I put the cipher command within, the CMD window closed. Yet the access LED on the USB stick kept right on blinking and the Task Manager showed the same level of read operations!

4. I did not see Cipher in the process list of Task Manager after terminating the CMD window.

5. Had to use the SysInternals Process Explorer utility to find that Cipher was still an active process!

6. I could NOT kill that process using any means I could think of. Access Denied all the time. Had to reboot the laptop to stop Cipher from running.

7. After running cipher, I used the utility called 'Disk Drill' which is a recovery tool for deleted files, to see what it would find on the USB stick. Interestingly it displayed a list of files, with the first letter of the filename changed and did processing to 'recover' the deleted files that cipher overwrote. A check of the contents of those files showed them to be blank. None of the file contents was found, which is a good thing.

So all this gets me to several things.

A. The cipher utility needs some work to properly work with a 'cipher /W' type of command. No getting stuck into an infinite loop reading and instead fully terminating processing within cipher when the data wipe completes and deleting the 'work file' it uses to overwrite almost all of the free data blocks on the disk.

B. It would be even more protective of privacy if the contents of the file headers that were marked as deleted, had the filename strings either replaced with blanks or put a garbage string in their place so there is NO HINTS about what files WERE on that storage device!

C: The contents of the deleted files is being overwritten by the creation of a new file which is sized for all available free space on the disk, while leaving a very small number of disk blocks free so a system might still be able to run while cipher runs against a Windows C: drive for example.

That's it for now.

Hopefully someone is listening in and can implement fixes and enhancements mentioned here.

Thanks!

Paul

As hdmi said above, ssd's and nvme's are different:

The safest way to wipe a SATA SSD is to use the tools designed for it. Most large SSD manufacturers provide free utilities, like Kingston SSD manager that take you through a secure erase in just a few clicks. The key here is to use the method intended for your specific drive, so you don’t shorten its life.
Kingston’s secure erase tool works by issuing the ATA Secure Erase command directly to the SSD’s controller, which instructs the drive to internally wipe all user-accessible data areas. Instead of overwriting files from the operating system level, the command triggers the controller’s built-in firmware routine to clear the flash translation layer and reset the NAND to a fresh state.

Click to expand...

Be sure to use the utility designed for your brand of SSD...

hdmi said:

The tutorial should clearly differentiate between HDDs and SSDs to avoid misleading users.

For SSDs, simply overwriting data blocks may not be sufficient due to the way data storage is managed internally by SSDs.

Click to expand...

Would anybody know if Western Digital has a utility to erase "windows-style"-deleted files, for their own SSDs?
My thingy is: WD PC SN740 SDDPMQD-512G-1101.

Is there perhaps any such deleted-files-only eraser for SSDs that is not brand-specific?

Chestnut said:

Would anybody know if Western Digital has a utility to erase "windows-style"-deleted files, for their own SSDs?
My thingy is: WD PC SN740 SDDPMQD-512G-1101.

Is there perhaps any such deleted-files-only eraser for SSDs that is not brand-specific?

Click to expand...

Chestnut said:

deleted-files-only eraser for SSDs

Click to expand...

The Key Value (KV) command set on modern enterprise SSDs enables the secure, targeted deletion of individual data objects.

Unlike traditional block-based SSDs, which require garbage collection and wear-leveling to manage deleted data making immediate, surgical [secure] deletion difficult, KV SSDs map data directly to a key, allowing the DELETE command to logically remove the object and potentially sanitize its physical storage location immediately.

Key Aspects of Individual Object Secure Erasure on KV SSDs:

• Object-Level Deletion (DELETE): The KV command set includes specific primitives like STORE, RETRIEVE, and DELETE. The DELETE command allows for the removal of a single key-value pair.
• Removal of Translation Layer Overheads: Because KV SSDs do not rely on the host to manage a complex Logical Block Address (LBA) mapping, deleting a key-value pair ensures the associated data is removed, and the physical space can be freed up without relying on slow, idle-time background garbage collection.
• Reduced Over-provisioning Challenges: In traditional storage, "deleted" data often resides in over-provisioned areas until the controller overwrites it. KV SSDs directly manage the key-value pair, making it easier for the firmware to securely erase the specific NAND cells associated with that object.
• Atomic Operations: The KV command set supports storing and deleting complete values, rather than block-level fragments, ensuring that the entire object is treated as a single entity for management.

While these features allow for immediate logical removal of data, for the highest level of security (e.g., preventing any forensic recovery), it is recommended to use KV drives that support cryptographic erasure, where the key associated with that specific object is destroyed.

The WD PC SN740 is a typical consumer SSD that doesn't support NVMe-KV. The best that it can do is let you run its NVMe Sanitize command with Block Erase, which causes it to wipe the entire SSD (i.e. all its user data blocks, internal metadata, logs, caches, and logical-to-physical mapping tables).