Solved Updated tutorial for RecycleBin Secure Delete

I have a new Windows 11 PC...a significant upgrade from the old Windows 10 machine.

In TenForums.com I found the tutorial for how to use SDelete from the Recycle Bin context menu to shred files that are deleted. This tutorial kind of works in Windows 11. The old Windows 10 registry entries to add the command to the context menu are still available, but only if I select "Show more options" from the context menu that is displayed when I right-click on the Recycle Bin icon. I looked through the tutorials on this site for an updated registry changes to add Secure Delete to the primary Win11 context menu, but was unable to find anything.

Did I miss something? Having this functionality available from the top context menu would be very useful for me.

Thanks,

Rick

Hi, Rick, welcome.

astrorick said:

The old Windows 10 registry entries to add the command to the context menu are still available, but only if I select "Show more options" from the context menu

Click to expand...

Have you considered removing “Show More Options” from the context menu?

Sorry about that, corrected the tutorial link.

I would only consider that if adding a Secure Delete entry to the primary menu is not possible.

Hello Rick, and welcome to the forum.

Is the tutorial below the one you used? It should add it directly to the Recycle Bin context menu.

Why would you want this Sdelete funktion? Don’t You ever empty your recycke Bin. I’m asuming you use SSD

I want deleted files to be overwritten so they are not recoverable. I keep my Recycle Bin empty. Doing a secure delete as the Recycle Bin is emptied is simpler than zeroing the free space on the drive every couple of days, if it can be accomplished by adding the Secure Delete item to the context menu.

astrorick said:

I want deleted files to be overwritten so they are not recoverable.

Click to expand...

There exists no such thing as secure deleting individual files (or alternate data streams, as that's how the Recycle Bin actually stores deleted items, but anyway...) on a SSD. Due to how physical allocation of data in the NAND is managed by the SSD's own internal processes and operations implemented in the SSD's firmware and controller ASIC, overwriting a data object that exists within the filesystem (such as a file or an NTFS alternate stream, for example) does not assure that the pages in the NAND that hold the original data will either be erased or be erased + rewritten. It just causes the newly written data to be stored elsewhere in the NAND. Elsewhere, i.e., in a free block.

SSDs are filesystem-unaware. Writing data to the SSD does not trigger garbage collection. The TRIM command does not assure that garbarge collection will be triggered either, and, even in situations when it actually does trigger it, garbage collection doesn't erase all the pages that only contain blocks marked as stale by TRIM. TRIM only marks blocks as stale, to indicate that the data stored in them is permitted to be erased during garbage collection. Permitted, i.e., not compulsory. It boils down to the fact that various, complex, internal optimizations inherent of SSD hardware technology including (but not limited to) wear-leveling and overprovisioning in conjunction with other strategic mechanisms to reduce write amplification effectively prevent secure erasure of individual, selectable portions of physical data.

As a result of this, you can only use Secure Erase (or Sanitize, which is the preferred method on SSDs that support Sanitize) to securely make all data stored on a SSD irrecoverable [which may be too impractical and therefore not what you want, as all data really means ALL data].

Unfortunately however, the only alternative choice is to rely on encryption [of the whole SSD]. Your Windows 11 Pro has BitLocker Drive Encryption, that you could set up such a way that it will use the built-in 256-bit encryption (Class 0) feature that is known as "Encrypted drive", or "eDrive" (and that merely translates to the fact that it is compliant with both TCG/Opal v2.0 and IEEE1667) of your Samsung 990 PRO. (TCG stands for Trusted Computing Group.)

Additionally, your Intel CPU has a Firmware TPM (fTPM) as part of its trusted execution environment (TEE). (TPM stands for Trusted Platform Module.) Your fTPM supports TCG specification version 2.0 which, as you probably know, is an official requirement of Windows 11. This fTPM can be used by BitLocker to store the BitLocker key in it so as to protect the key. That is, although personally, I, have my reasons to be more than just a little bit leery of BitLocker. Even TPM 2.0 itself has vulnerabilities, but some of the numerous flaws that have also been discovered in BitLocker over the past few years turned out to be so bad I mean, there's only one word to describe it IMNSHO: preposterous. So much so, I never use it. I am sorry I couldn't be more helpful. It is what it is, at least for now.

Thanks for your reply. It was useful.