Friday, March 20, 2020

Securely wipe a file, folder, or entire drive with Microsoft's sdelete

I recently wanted to wipe a 1TB drive before donating. I just wanted to make sure my bits were not easily regained from this thing. I know a format would do the trick but who knows who's out there buying up used HHD to try to recover old data. My initial search turned up shareware as well as costly apps. Since this was a passing curiosity, I wasn't going to spend money so the first free one that caught my eye was from diskwipe.org. Running it requires admin rights, so I let it. Fist thing I noticed is it doesn't let you chose a physical drive, only drive letters were available. Not impressed so far, I decided not to give up and I chose the drive letter and clicked Wipe Disk. The next disappointment was it wanted me to select a file system and format options. Wait a second, is this just a format utility? Still in a curious mood, I used NTFS and clicked next. Okay, finally some promise; I'm asked for the erasing pattern I want to use. Options are
One Pass Zeros (quick)
One Pass Random (quick)
Russian GOST P50739-95 (2 passes - quick)
British HMG IS5 (3 passes - slow)
US Department of Defense DoD 5220.22-M(E) (3 passes - slow)
US Department of Defense DoD 5220.22-M(ECE) (7 passes - very slow)
Peter Guttman (35 passes - extremely slow)
Impressive, right? I choose a simple one; "One Pass Random (quick)" and let it go. It fails but I notice Windows Defender interfering. Let's take a look, what! FORMAT.COM wants to access my K: drive. Is FORMAT.COM still a thing? So this app is using a built-in utility to do this? Confidence level hits the floor and I'm no longer interested in this utility from 2012. Lesson learned.

All of that takes me to Mark Russinovich's Sdelete which was already on my system (because it's included in Microsoft's Sysinternals Suite.) It can wipe files, folders, and, to my surprise, whole disks right down to low-level. I've used it in the past to securely delete folders using delete -p 2 -s E:\VirtualMachines\VirtualMachine01. These parameters are for 2 passes (-p 2) and subdirectories -s. Okay, finally a utility I know how to use. It can at very least wipe files, folders, and free space on the volume but what else can it do? Well, the help contents usage showed a third option with no explanation...
sdelete [-p passes] [-z|-c] <physical disk number>
THAT'S IT! I fed it the disk number found in Disk Manager and it took off. 

PS D:\Perm\SysinternalsSuite> .\sdelete.exe -z -c 6

SDelete v2.01 - Secure file delete
Copyright (C) 1999-2018 Mark Russinovich
Sysinternals - www.sysinternals.com

SDelete is set for 1 pass.

Cleaning disk 6:
Pass 0 progress: 20% (41.47 MB/s)

Looking at the drive in disk manager I could see volumes disappearing from the disk. This is what I've been looking for and from someone I trust.

So in short, if you're looking to wipe a drive before giving it to someone else, Sysinternals Sdelete, with the options above, is your answer.

No comments:

Post a Comment