Skip to main content
Hands-on lab

Overwrite free space with cipher and understand what it does not sanitize

On a canned Windows volume, run fsutil volume diskfree C: to see the free space, then cipher /w:C:\ to overwrite that free space in three passes so deleted-file remnants cannot be recovered by software. This is not a NIST SP 800-88 Clear of the whole medium, it cannot reach an SSD's remapped cells, and it is not disposal sanitization; disposal needs Clear, Purge, or Destroy chosen by media, sensitivity, policy, and residual risk. cipher gives no independent verification. Do not claim this canned volume is real. This page teaches a job procedure. These are not exam questions, this is not a score predictor, and nothing here is taken from any certification exam.

Steps

  1. 1

    Run fsutil volume diskfree C:. Read the free and total bytes the overwrite will cover.

  2. 2

    Run cipher /w:C:\. Watch the three passes (0x00, 0xFF, random) and the return to the prompt; that transcript is the only completion cue cipher gives.

What you should see

fsutil reported the free space; cipher /w ran the three passes and returned to the prompt with no error. Nothing verifies sanitization, and a free-space overwrite is not disposal.

Study the concept