Is there a reason cipher /w fills up temporary files instead of writing to the raw disk?











up vote
1
down vote

favorite












The Windows command cipher /w can be used to securely wipe a hard drive's free space without the use of third-party tools or GUIs:



enter image description here



cipher works by creating a folder called EFSTMPWP on the root of the target drive; inside this folder, it successively fills three temporary files with zeroes, ones, and random numbers respectively, one after the other, to the size of the empty space left on the drive.



By the time a file has taken up all of the drive's empty space, it's effectively forced the file system to overwrite all data held in its free space with the file's newly-written data, rendering any data previously held there permanently irrecoverable.



enter image description here



I understand Windows doesn't typically grant users access to the raw drive like Linux does, but I'm confused as to why Windows' own utilities would choose to write data indirectly to files in this way and be subjected to disk I/O bottlenecks in the process, instead of simply writing to the raw disk itself.



Is there a particular reason it wipes disks using files instead of writing to the raw disk, or was this likely just a design oversight?










share|improve this question




















  • 1




    Let me know if you are truly looking for a logical answer or if this was just to scrutinize Microsoft and/or this tool their developers designed or whatever. I can draw a logical conclusion based on what detail MS provides for us to read, and some plain old common sense.
    – Pimp Juice IT
    Nov 10 at 7:59












  • Hashim - Your question was on the brink of closure and may very well still be—hopefully my edit will help with this respect—I'm not sure. I had to edit to make your main points to the point and rephrase the other statements to be in form of statements and not so much questions. Obviously I wrote an answer on it before I edited it and only did so (made an edit) in the name of trying to make the post as helpful to people with the same questions or thoughts on the topic you though about here.
    – Pimp Juice IT
    Nov 11 at 18:30








  • 1




    @PimpJuiceIT A logical inference from a mixture of MS documentation and technical knowledge is precisely what I'm looking for, and your answer fits the bill fine. Note that I've rolled back any edits you made to the question that diverged from the original question I was asking. If the question is closed then so be it, but I'd rather not drastically change the core of what I'm asking just to ensure it remains open. If it does get closed, then I'll make a Meta thread for it, as I've seen questions with a similar format and am convinced that according to the Help Center it's on-topic.
    – Hashim
    Nov 11 at 19:14

















up vote
1
down vote

favorite












The Windows command cipher /w can be used to securely wipe a hard drive's free space without the use of third-party tools or GUIs:



enter image description here



cipher works by creating a folder called EFSTMPWP on the root of the target drive; inside this folder, it successively fills three temporary files with zeroes, ones, and random numbers respectively, one after the other, to the size of the empty space left on the drive.



By the time a file has taken up all of the drive's empty space, it's effectively forced the file system to overwrite all data held in its free space with the file's newly-written data, rendering any data previously held there permanently irrecoverable.



enter image description here



I understand Windows doesn't typically grant users access to the raw drive like Linux does, but I'm confused as to why Windows' own utilities would choose to write data indirectly to files in this way and be subjected to disk I/O bottlenecks in the process, instead of simply writing to the raw disk itself.



Is there a particular reason it wipes disks using files instead of writing to the raw disk, or was this likely just a design oversight?










share|improve this question




















  • 1




    Let me know if you are truly looking for a logical answer or if this was just to scrutinize Microsoft and/or this tool their developers designed or whatever. I can draw a logical conclusion based on what detail MS provides for us to read, and some plain old common sense.
    – Pimp Juice IT
    Nov 10 at 7:59












  • Hashim - Your question was on the brink of closure and may very well still be—hopefully my edit will help with this respect—I'm not sure. I had to edit to make your main points to the point and rephrase the other statements to be in form of statements and not so much questions. Obviously I wrote an answer on it before I edited it and only did so (made an edit) in the name of trying to make the post as helpful to people with the same questions or thoughts on the topic you though about here.
    – Pimp Juice IT
    Nov 11 at 18:30








  • 1




    @PimpJuiceIT A logical inference from a mixture of MS documentation and technical knowledge is precisely what I'm looking for, and your answer fits the bill fine. Note that I've rolled back any edits you made to the question that diverged from the original question I was asking. If the question is closed then so be it, but I'd rather not drastically change the core of what I'm asking just to ensure it remains open. If it does get closed, then I'll make a Meta thread for it, as I've seen questions with a similar format and am convinced that according to the Help Center it's on-topic.
    – Hashim
    Nov 11 at 19:14















up vote
1
down vote

favorite









up vote
1
down vote

favorite











The Windows command cipher /w can be used to securely wipe a hard drive's free space without the use of third-party tools or GUIs:



enter image description here



cipher works by creating a folder called EFSTMPWP on the root of the target drive; inside this folder, it successively fills three temporary files with zeroes, ones, and random numbers respectively, one after the other, to the size of the empty space left on the drive.



By the time a file has taken up all of the drive's empty space, it's effectively forced the file system to overwrite all data held in its free space with the file's newly-written data, rendering any data previously held there permanently irrecoverable.



enter image description here



I understand Windows doesn't typically grant users access to the raw drive like Linux does, but I'm confused as to why Windows' own utilities would choose to write data indirectly to files in this way and be subjected to disk I/O bottlenecks in the process, instead of simply writing to the raw disk itself.



Is there a particular reason it wipes disks using files instead of writing to the raw disk, or was this likely just a design oversight?










share|improve this question















The Windows command cipher /w can be used to securely wipe a hard drive's free space without the use of third-party tools or GUIs:



enter image description here



cipher works by creating a folder called EFSTMPWP on the root of the target drive; inside this folder, it successively fills three temporary files with zeroes, ones, and random numbers respectively, one after the other, to the size of the empty space left on the drive.



By the time a file has taken up all of the drive's empty space, it's effectively forced the file system to overwrite all data held in its free space with the file's newly-written data, rendering any data previously held there permanently irrecoverable.



enter image description here



I understand Windows doesn't typically grant users access to the raw drive like Linux does, but I'm confused as to why Windows' own utilities would choose to write data indirectly to files in this way and be subjected to disk I/O bottlenecks in the process, instead of simply writing to the raw disk itself.



Is there a particular reason it wipes disks using files instead of writing to the raw disk, or was this likely just a design oversight?







windows hard-drive command-line security cmd.exe






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 11 at 19:06

























asked Nov 9 at 0:28









Hashim

2,83962852




2,83962852








  • 1




    Let me know if you are truly looking for a logical answer or if this was just to scrutinize Microsoft and/or this tool their developers designed or whatever. I can draw a logical conclusion based on what detail MS provides for us to read, and some plain old common sense.
    – Pimp Juice IT
    Nov 10 at 7:59












  • Hashim - Your question was on the brink of closure and may very well still be—hopefully my edit will help with this respect—I'm not sure. I had to edit to make your main points to the point and rephrase the other statements to be in form of statements and not so much questions. Obviously I wrote an answer on it before I edited it and only did so (made an edit) in the name of trying to make the post as helpful to people with the same questions or thoughts on the topic you though about here.
    – Pimp Juice IT
    Nov 11 at 18:30








  • 1




    @PimpJuiceIT A logical inference from a mixture of MS documentation and technical knowledge is precisely what I'm looking for, and your answer fits the bill fine. Note that I've rolled back any edits you made to the question that diverged from the original question I was asking. If the question is closed then so be it, but I'd rather not drastically change the core of what I'm asking just to ensure it remains open. If it does get closed, then I'll make a Meta thread for it, as I've seen questions with a similar format and am convinced that according to the Help Center it's on-topic.
    – Hashim
    Nov 11 at 19:14
















  • 1




    Let me know if you are truly looking for a logical answer or if this was just to scrutinize Microsoft and/or this tool their developers designed or whatever. I can draw a logical conclusion based on what detail MS provides for us to read, and some plain old common sense.
    – Pimp Juice IT
    Nov 10 at 7:59












  • Hashim - Your question was on the brink of closure and may very well still be—hopefully my edit will help with this respect—I'm not sure. I had to edit to make your main points to the point and rephrase the other statements to be in form of statements and not so much questions. Obviously I wrote an answer on it before I edited it and only did so (made an edit) in the name of trying to make the post as helpful to people with the same questions or thoughts on the topic you though about here.
    – Pimp Juice IT
    Nov 11 at 18:30








  • 1




    @PimpJuiceIT A logical inference from a mixture of MS documentation and technical knowledge is precisely what I'm looking for, and your answer fits the bill fine. Note that I've rolled back any edits you made to the question that diverged from the original question I was asking. If the question is closed then so be it, but I'd rather not drastically change the core of what I'm asking just to ensure it remains open. If it does get closed, then I'll make a Meta thread for it, as I've seen questions with a similar format and am convinced that according to the Help Center it's on-topic.
    – Hashim
    Nov 11 at 19:14










1




1




Let me know if you are truly looking for a logical answer or if this was just to scrutinize Microsoft and/or this tool their developers designed or whatever. I can draw a logical conclusion based on what detail MS provides for us to read, and some plain old common sense.
– Pimp Juice IT
Nov 10 at 7:59






Let me know if you are truly looking for a logical answer or if this was just to scrutinize Microsoft and/or this tool their developers designed or whatever. I can draw a logical conclusion based on what detail MS provides for us to read, and some plain old common sense.
– Pimp Juice IT
Nov 10 at 7:59














Hashim - Your question was on the brink of closure and may very well still be—hopefully my edit will help with this respect—I'm not sure. I had to edit to make your main points to the point and rephrase the other statements to be in form of statements and not so much questions. Obviously I wrote an answer on it before I edited it and only did so (made an edit) in the name of trying to make the post as helpful to people with the same questions or thoughts on the topic you though about here.
– Pimp Juice IT
Nov 11 at 18:30






Hashim - Your question was on the brink of closure and may very well still be—hopefully my edit will help with this respect—I'm not sure. I had to edit to make your main points to the point and rephrase the other statements to be in form of statements and not so much questions. Obviously I wrote an answer on it before I edited it and only did so (made an edit) in the name of trying to make the post as helpful to people with the same questions or thoughts on the topic you though about here.
– Pimp Juice IT
Nov 11 at 18:30






1




1




@PimpJuiceIT A logical inference from a mixture of MS documentation and technical knowledge is precisely what I'm looking for, and your answer fits the bill fine. Note that I've rolled back any edits you made to the question that diverged from the original question I was asking. If the question is closed then so be it, but I'd rather not drastically change the core of what I'm asking just to ensure it remains open. If it does get closed, then I'll make a Meta thread for it, as I've seen questions with a similar format and am convinced that according to the Help Center it's on-topic.
– Hashim
Nov 11 at 19:14






@PimpJuiceIT A logical inference from a mixture of MS documentation and technical knowledge is precisely what I'm looking for, and your answer fits the bill fine. Note that I've rolled back any edits you made to the question that diverged from the original question I was asking. If the question is closed then so be it, but I'd rather not drastically change the core of what I'm asking just to ensure it remains open. If it does get closed, then I'll make a Meta thread for it, as I've seen questions with a similar format and am convinced that according to the Help Center it's on-topic.
– Hashim
Nov 11 at 19:14












1 Answer
1






active

oldest

votes

















up vote
2
down vote



accepted










Looking over cipher /? from command line I see that the cipher command/app does much more than just the operations that occur when using the /w option. As stated in the help it is used to display and alter the encryption of directories and files on NTFS partitions.



It seems to me that the /w switch with this command is just a simple function that works with files and folders only on NTFS partitions as per it's core functionality description via chipher /?.




cipher /?



Displays or alters the encryption of directories [files] on NTFS partitions.

/W Removes data from available unused disk space on the entire
volume. If this option is chosen, all other options are ignored.
The directory specified can be anywhere in a local volume. If it
is a mount point or points to a directory in another volume, the
data on that volume will be removed.





A few specific things to point out per the Microsoft post "How to use Cipher.exe to overwrite deleted data in Windows~"
regarding this tool's specific functionality. . .




  1. this command/app was apparently designed in the days of Windows 2003 (maybe it's even older) so consider using another tool if it doesn't suffice for your task/operation needs.


  2. there's a mentioned gotcha with the /w option functionality with files smaller than 1 KB so if smaller than 1 KB files is important to you, use another tool.


  3. it states it can take a long time to complete if there's a lot of free space to be overwritten so it's not like they are claiming this tool is an efficient raw disk I/O beast—use another tool if that's a problem for your needs.





Knowing all this it seems the additional I/O overhead and bottleneck risks you mention were not of any importance or concern when this functionality was designed.



This tool does nothing special with this functionality (working with files and folders on NTFS partitions) that another native Windows method could not do; this specific functionality is not robust.



See the "How to zero fill a virtual disk's free space on windows for better compression" post and the answer on there regarding fsutil for another native Windows method to zero fill free space.





  • FSUTIL



    fsutil volume diskfree f:


    Which showed this report:



    Total # of free bytes        : 249899469856
    Total # of bytes : 249997291520
    Total # of avail free bytes : 249899469856


    I used Total # of avail free bytes in the following commands:



    fsutil file createnew F:clear 249899469856
    fsutil file setvaliddata F:clear 249899469856
    fsutil file setzerodata offset=0 length=249899469856 F:clear
    del f:clear


    It took about 4 hours to write 250GB of zeros.



    Source






Further Resources





  • CIPHER.exe




    /w:PathName



         Remove data from unused portions of a volume.
    PathName can indicate any directory on the desired volume.
    Cipher does not obtain an exclusive lock on the drive.
    This option can take a long time to complete and should only be used when necessary.




  • How to use Cipher.exe to overwrite deleted data in Windows~




    Note The cipher /w command does not work for files that are smaller
    than 1 KB. Therefore, make sure that you check the file size to
    confirm whether is smaller than 1 KB. This issue is scheduled to be
    fixed in longhorn.



    Data that is not allocated to files or folders is overwritten. This permanently removes the data. This can take a long time if you are overwriting a large amount of space.









share|improve this answer























    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "3"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














     

    draft saved


    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1373951%2fis-there-a-reason-cipher-w-fills-up-temporary-files-instead-of-writing-to-the-r%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes








    up vote
    2
    down vote



    accepted










    Looking over cipher /? from command line I see that the cipher command/app does much more than just the operations that occur when using the /w option. As stated in the help it is used to display and alter the encryption of directories and files on NTFS partitions.



    It seems to me that the /w switch with this command is just a simple function that works with files and folders only on NTFS partitions as per it's core functionality description via chipher /?.




    cipher /?



    Displays or alters the encryption of directories [files] on NTFS partitions.

    /W Removes data from available unused disk space on the entire
    volume. If this option is chosen, all other options are ignored.
    The directory specified can be anywhere in a local volume. If it
    is a mount point or points to a directory in another volume, the
    data on that volume will be removed.





    A few specific things to point out per the Microsoft post "How to use Cipher.exe to overwrite deleted data in Windows~"
    regarding this tool's specific functionality. . .




    1. this command/app was apparently designed in the days of Windows 2003 (maybe it's even older) so consider using another tool if it doesn't suffice for your task/operation needs.


    2. there's a mentioned gotcha with the /w option functionality with files smaller than 1 KB so if smaller than 1 KB files is important to you, use another tool.


    3. it states it can take a long time to complete if there's a lot of free space to be overwritten so it's not like they are claiming this tool is an efficient raw disk I/O beast—use another tool if that's a problem for your needs.





    Knowing all this it seems the additional I/O overhead and bottleneck risks you mention were not of any importance or concern when this functionality was designed.



    This tool does nothing special with this functionality (working with files and folders on NTFS partitions) that another native Windows method could not do; this specific functionality is not robust.



    See the "How to zero fill a virtual disk's free space on windows for better compression" post and the answer on there regarding fsutil for another native Windows method to zero fill free space.





    • FSUTIL



      fsutil volume diskfree f:


      Which showed this report:



      Total # of free bytes        : 249899469856
      Total # of bytes : 249997291520
      Total # of avail free bytes : 249899469856


      I used Total # of avail free bytes in the following commands:



      fsutil file createnew F:clear 249899469856
      fsutil file setvaliddata F:clear 249899469856
      fsutil file setzerodata offset=0 length=249899469856 F:clear
      del f:clear


      It took about 4 hours to write 250GB of zeros.



      Source






    Further Resources





    • CIPHER.exe




      /w:PathName



           Remove data from unused portions of a volume.
      PathName can indicate any directory on the desired volume.
      Cipher does not obtain an exclusive lock on the drive.
      This option can take a long time to complete and should only be used when necessary.




    • How to use Cipher.exe to overwrite deleted data in Windows~




      Note The cipher /w command does not work for files that are smaller
      than 1 KB. Therefore, make sure that you check the file size to
      confirm whether is smaller than 1 KB. This issue is scheduled to be
      fixed in longhorn.



      Data that is not allocated to files or folders is overwritten. This permanently removes the data. This can take a long time if you are overwriting a large amount of space.









    share|improve this answer



























      up vote
      2
      down vote



      accepted










      Looking over cipher /? from command line I see that the cipher command/app does much more than just the operations that occur when using the /w option. As stated in the help it is used to display and alter the encryption of directories and files on NTFS partitions.



      It seems to me that the /w switch with this command is just a simple function that works with files and folders only on NTFS partitions as per it's core functionality description via chipher /?.




      cipher /?



      Displays or alters the encryption of directories [files] on NTFS partitions.

      /W Removes data from available unused disk space on the entire
      volume. If this option is chosen, all other options are ignored.
      The directory specified can be anywhere in a local volume. If it
      is a mount point or points to a directory in another volume, the
      data on that volume will be removed.





      A few specific things to point out per the Microsoft post "How to use Cipher.exe to overwrite deleted data in Windows~"
      regarding this tool's specific functionality. . .




      1. this command/app was apparently designed in the days of Windows 2003 (maybe it's even older) so consider using another tool if it doesn't suffice for your task/operation needs.


      2. there's a mentioned gotcha with the /w option functionality with files smaller than 1 KB so if smaller than 1 KB files is important to you, use another tool.


      3. it states it can take a long time to complete if there's a lot of free space to be overwritten so it's not like they are claiming this tool is an efficient raw disk I/O beast—use another tool if that's a problem for your needs.





      Knowing all this it seems the additional I/O overhead and bottleneck risks you mention were not of any importance or concern when this functionality was designed.



      This tool does nothing special with this functionality (working with files and folders on NTFS partitions) that another native Windows method could not do; this specific functionality is not robust.



      See the "How to zero fill a virtual disk's free space on windows for better compression" post and the answer on there regarding fsutil for another native Windows method to zero fill free space.





      • FSUTIL



        fsutil volume diskfree f:


        Which showed this report:



        Total # of free bytes        : 249899469856
        Total # of bytes : 249997291520
        Total # of avail free bytes : 249899469856


        I used Total # of avail free bytes in the following commands:



        fsutil file createnew F:clear 249899469856
        fsutil file setvaliddata F:clear 249899469856
        fsutil file setzerodata offset=0 length=249899469856 F:clear
        del f:clear


        It took about 4 hours to write 250GB of zeros.



        Source






      Further Resources





      • CIPHER.exe




        /w:PathName



             Remove data from unused portions of a volume.
        PathName can indicate any directory on the desired volume.
        Cipher does not obtain an exclusive lock on the drive.
        This option can take a long time to complete and should only be used when necessary.




      • How to use Cipher.exe to overwrite deleted data in Windows~




        Note The cipher /w command does not work for files that are smaller
        than 1 KB. Therefore, make sure that you check the file size to
        confirm whether is smaller than 1 KB. This issue is scheduled to be
        fixed in longhorn.



        Data that is not allocated to files or folders is overwritten. This permanently removes the data. This can take a long time if you are overwriting a large amount of space.









      share|improve this answer

























        up vote
        2
        down vote



        accepted







        up vote
        2
        down vote



        accepted






        Looking over cipher /? from command line I see that the cipher command/app does much more than just the operations that occur when using the /w option. As stated in the help it is used to display and alter the encryption of directories and files on NTFS partitions.



        It seems to me that the /w switch with this command is just a simple function that works with files and folders only on NTFS partitions as per it's core functionality description via chipher /?.




        cipher /?



        Displays or alters the encryption of directories [files] on NTFS partitions.

        /W Removes data from available unused disk space on the entire
        volume. If this option is chosen, all other options are ignored.
        The directory specified can be anywhere in a local volume. If it
        is a mount point or points to a directory in another volume, the
        data on that volume will be removed.





        A few specific things to point out per the Microsoft post "How to use Cipher.exe to overwrite deleted data in Windows~"
        regarding this tool's specific functionality. . .




        1. this command/app was apparently designed in the days of Windows 2003 (maybe it's even older) so consider using another tool if it doesn't suffice for your task/operation needs.


        2. there's a mentioned gotcha with the /w option functionality with files smaller than 1 KB so if smaller than 1 KB files is important to you, use another tool.


        3. it states it can take a long time to complete if there's a lot of free space to be overwritten so it's not like they are claiming this tool is an efficient raw disk I/O beast—use another tool if that's a problem for your needs.





        Knowing all this it seems the additional I/O overhead and bottleneck risks you mention were not of any importance or concern when this functionality was designed.



        This tool does nothing special with this functionality (working with files and folders on NTFS partitions) that another native Windows method could not do; this specific functionality is not robust.



        See the "How to zero fill a virtual disk's free space on windows for better compression" post and the answer on there regarding fsutil for another native Windows method to zero fill free space.





        • FSUTIL



          fsutil volume diskfree f:


          Which showed this report:



          Total # of free bytes        : 249899469856
          Total # of bytes : 249997291520
          Total # of avail free bytes : 249899469856


          I used Total # of avail free bytes in the following commands:



          fsutil file createnew F:clear 249899469856
          fsutil file setvaliddata F:clear 249899469856
          fsutil file setzerodata offset=0 length=249899469856 F:clear
          del f:clear


          It took about 4 hours to write 250GB of zeros.



          Source






        Further Resources





        • CIPHER.exe




          /w:PathName



               Remove data from unused portions of a volume.
          PathName can indicate any directory on the desired volume.
          Cipher does not obtain an exclusive lock on the drive.
          This option can take a long time to complete and should only be used when necessary.




        • How to use Cipher.exe to overwrite deleted data in Windows~




          Note The cipher /w command does not work for files that are smaller
          than 1 KB. Therefore, make sure that you check the file size to
          confirm whether is smaller than 1 KB. This issue is scheduled to be
          fixed in longhorn.



          Data that is not allocated to files or folders is overwritten. This permanently removes the data. This can take a long time if you are overwriting a large amount of space.









        share|improve this answer














        Looking over cipher /? from command line I see that the cipher command/app does much more than just the operations that occur when using the /w option. As stated in the help it is used to display and alter the encryption of directories and files on NTFS partitions.



        It seems to me that the /w switch with this command is just a simple function that works with files and folders only on NTFS partitions as per it's core functionality description via chipher /?.




        cipher /?



        Displays or alters the encryption of directories [files] on NTFS partitions.

        /W Removes data from available unused disk space on the entire
        volume. If this option is chosen, all other options are ignored.
        The directory specified can be anywhere in a local volume. If it
        is a mount point or points to a directory in another volume, the
        data on that volume will be removed.





        A few specific things to point out per the Microsoft post "How to use Cipher.exe to overwrite deleted data in Windows~"
        regarding this tool's specific functionality. . .




        1. this command/app was apparently designed in the days of Windows 2003 (maybe it's even older) so consider using another tool if it doesn't suffice for your task/operation needs.


        2. there's a mentioned gotcha with the /w option functionality with files smaller than 1 KB so if smaller than 1 KB files is important to you, use another tool.


        3. it states it can take a long time to complete if there's a lot of free space to be overwritten so it's not like they are claiming this tool is an efficient raw disk I/O beast—use another tool if that's a problem for your needs.





        Knowing all this it seems the additional I/O overhead and bottleneck risks you mention were not of any importance or concern when this functionality was designed.



        This tool does nothing special with this functionality (working with files and folders on NTFS partitions) that another native Windows method could not do; this specific functionality is not robust.



        See the "How to zero fill a virtual disk's free space on windows for better compression" post and the answer on there regarding fsutil for another native Windows method to zero fill free space.





        • FSUTIL



          fsutil volume diskfree f:


          Which showed this report:



          Total # of free bytes        : 249899469856
          Total # of bytes : 249997291520
          Total # of avail free bytes : 249899469856


          I used Total # of avail free bytes in the following commands:



          fsutil file createnew F:clear 249899469856
          fsutil file setvaliddata F:clear 249899469856
          fsutil file setzerodata offset=0 length=249899469856 F:clear
          del f:clear


          It took about 4 hours to write 250GB of zeros.



          Source






        Further Resources





        • CIPHER.exe




          /w:PathName



               Remove data from unused portions of a volume.
          PathName can indicate any directory on the desired volume.
          Cipher does not obtain an exclusive lock on the drive.
          This option can take a long time to complete and should only be used when necessary.




        • How to use Cipher.exe to overwrite deleted data in Windows~




          Note The cipher /w command does not work for files that are smaller
          than 1 KB. Therefore, make sure that you check the file size to
          confirm whether is smaller than 1 KB. This issue is scheduled to be
          fixed in longhorn.



          Data that is not allocated to files or folders is overwritten. This permanently removes the data. This can take a long time if you are overwriting a large amount of space.










        share|improve this answer














        share|improve this answer



        share|improve this answer








        edited Nov 15 at 2:22

























        answered Nov 9 at 6:23









        Pimp Juice IT

        22.6k113869




        22.6k113869






























             

            draft saved


            draft discarded



















































             


            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1373951%2fis-there-a-reason-cipher-w-fills-up-temporary-files-instead-of-writing-to-the-r%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            Plaza Victoria

            In PowerPoint, is there a keyboard shortcut for bulleted / numbered list?

            How to put 3 figures in Latex with 2 figures side by side and 1 below these side by side images but in...