How to Use the cipher /w Command in Windows 11 to Securely Wipe Deleted Data from Free Space

When you delete a file in Windows 11 and empty the Recycle Bin, the operating system does not physically erase the binary data from your storage drive. Instead, the NTFS filesystem simply removes the file’s index pointer from the Master File Table (MFT) and marks those storage sectors as “unallocated” or free space. Until new files happen to overwrite those exact sectors, commercial file recovery utilities can easily reconstruct sensitive financial spreadsheets, personal photos, and passwords. To prevent data recovery without downloading third-party shredder software, Windows 11 includes the cipher /w command.

How the cipher /w Command Functions

Originally designed as an administrative tool for managing Encrypting File System (EFS) certificates, the /w parameter instructs the utility to sanitize unallocated storage sectors across a specified partition or directory tree. Crucially, cipher /w does not delete or harm any existing active files; it targets only free, unallocated drive space where deleted remnants reside.

To ensure military-grade data sanitization compliant with government security standards, cipher /w executes three sequential write passes across every unallocated cluster:

1. Pass 1 (Zero Fill): Overwrites all free sectors entirely with binary zeroes (0x00).
2. Pass 2 (One Fill): Overwrites all free sectors entirely with binary ones (0xFF).
3. Pass 3 (Random Noise): Overwrites all free sectors with cryptographically generated random numbers.

Step-by-Step: Running cipher /w in Windows 11

1. Empty the Windows Recycle Bin

Because cipher /w operates only on unallocated free space, files currently residing inside the Recycle Bin are considered active allocated files. Right-click the Recycle Bin icon on your desktop and select Empty Recycle Bin before proceeding.

2. Open Windows Terminal as Administrator

1. Press Win + X on your keyboard.
2. Select Terminal (Admin) or PowerShell (Admin). Elevated permissions are required to write raw data blocks directly to filesystem storage clusters.

3. Execute the Wipe Command

To sanitize all unallocated free space across your primary system drive (C:), execute:

cipher /w:C:

To sanitize free space on an external backup drive or USB flash drive mounted as drive D::

cipher /w:D:

4. Monitoring Execution Progress

Upon launching, the terminal displays: To remove as much data as possible, please close all other applications while running CIPHER /W. The command displays progressive periods as it completes each of the three write passes:

• Writing 0x00 ........................................
• Writing 0xFF ........................................
• Writing Random Numbers .............................

Important Operational Tips for SSDs and NVMe Drives

• Execution Time: Sanitizing large drives (e.g., 500GB of free space) can take from 30 minutes to several hours depending on drive write speeds.
• Solid-State Drives (SSDs): Modern NVMe and SATA SSDs utilize hardware-level TRIM and wear-leveling algorithms that routinely purge unallocated NAND blocks. However, running cipher /w provides guaranteed forensic-level erasure when preparing laptops for sale, donation, or return to corporate IT departments.