Make deleted files unrecoverable on Windows 11, 10 with Cipher

On Windows 11, those deleted files can be recoverable. Use the Cipher tool to remove them permanently from the hard drive.

Windows 11 Cipher tool
Windows 11 Cipher tool
  • To erase deleted files beyond recovery on Windows 11 (or 10), use the “cipher /w:DRIVE-LETTER:\FOLDER-PATH\” or “cipher /w:DRIVE-LETTER:\” command.

On Windows 11, you can use the “Cipher” tool to wipe out deleted data from the hard drive to make it unrecoverable without formatting the entire storage, and in this guide, I’ll walk you through the steps to use this tool.

Cipher.exe is a command-line tool that has been around for a long time in the client and server versions of the operating system. Microsoft designed the utility to encrypt and decrypt data from drives using the NTFS file system. However, you can also use it to overwrite deleted data to prevent recovery.

When you delete a file or folder, the system does not immediately remove the data from the hard drive. Instead, it marks the data for deletion and keeps it available until other data overwrites it. It’s why you can recover accidentally deleted data and why it is always best to stop using the device immediately after accidental deletion to improve your chances of recovery using special software.

If you have deleted data beyond the Recycle Bin and want to ensure it’s unrecoverable, you can use the Cipher tool in Command Prompt to overwrite it with zeros and ones, making it difficult to recover.

In this guide, I’ll outline the steps to use the command-line tool to overwrite deleted data to wipe out the information for the hard drive on Windows 11 (as well as on Windows 10).

Use Cipher to overwrite deleted data on Windows 11

To wipe out deleted data from the drive with Cipher on Windows 11 (or 10), use these steps:

  1. Open Start on Windows 11.

  2. Search for Command Prompt, right-click the top result, and choose the Run as administrator option.

  3. Type the following command to securely erase deleted data and press Enter/p>

    cipher /w:DRIVE-LETTER:\FOLDER-PATH\

    Cipher overwrite deleted data command

    In the command, replace “DRIVE-LETTER” with the drive letter with the deleted content and “FOLDER-PATH” with the path to the folder to completely erase from the hard drive. For example, this command uses Cipher to wipe out the “aws-rclone-test” folder that I previously deleted: cipher /w:c:\aws-rclone-test

  4. Type the following command to securely erase the free space that may contain deleted data information and press Enter:

    cipher /w:DRIVE-LETTER:\

    In the command, replace “DRIVE-LETTER” with the drive letter of the storage you want to wipe out the free space. For example, this command wipes out only the free available space of the “C:\” that may contain recoverable data: cipher /w:c:\

  5. (Optional) Type the following command to overwrite deleted data with multiple passes and press Enter:

    cipher /w:DRIVE-LETTER:\ /p3

    In the command, replace “DRIVE-LETTER” with the drive letter of the storage you want to wipe out the free space. You can also change “3” for the number of passes you wish to use. The greater the number, the more time it will take to complete the process.

Once you complete the steps, Cipher will overwrite the deleted data, making it very difficult for anyone to use recovery software to reconstruct and restore the files and folders from the hard drive.

Cipher only overwrites free available space where deleted data may still reside. It doesn’t wipe out the existing and accessible data. You can also run this tool in the “C:\” drive where the operating system is installed.

About the author

Mauro Huculak is a Windows How-To Expert who started Pureinfotech in 2010 as an independent online publication. He has also been a Windows Central contributor for nearly a decade. Mauro has over 15 years of experience writing comprehensive guides and creating professional videos about Windows and software, including Android and Linux. Before becoming a technology writer, he was an IT administrator for seven years. In total, Mauro has over 21 years of combined experience in technology. Throughout his career, he achieved different professional certifications from Microsoft (MSCA), Cisco (CCNP), VMware (VCP), and CompTIA (A+ and Network+), and he has been recognized as a Microsoft MVP for many years. You can follow him on X (Twitter), YouTube, LinkedIn and About.me. Email him at [email protected].