What is the different between sdelete -c and -z?

27

5

I've learned from this article to use sdelete as a step to shrink VDI file:

sdelete -c c:

But what does the -c ('Clean free space' as described by its help text) mean? Doesn't it write free space with zero? And what about -z(Zero free space)? What is the different between sdelete -c and -z?

Edit

I tried the step in the article mentioned before, but failed to reduce the size of the .vid file. Then I followed this superuser post, and changed the option -c to -z, and succeeded.

So it seems -z writes zeros to free space, and -c writes something else (random bits possibly).

Frozen Flame

Posted 2014-04-30T06:01:42.090

Reputation: 880

Answers

22

I think this is a common mistake. Maybe the -z option was not available in earlier versions. SDelete 1.61 says

-z         Zero free space (good for virtual disk optimization)

Note that doing so will first expand your hard disk to the full size. Only in the shrinking process by VMWare it will become smaller again.

A quick test on my machine:

-z took 1:01 minutes
-c took 2:11 minutes

Which indicates that -z only writes simple zeros whereas -c is the military standard wiping DoD 5220.22-M as written on the SDelete website.

Thomas Weller

Posted 2014-04-30T06:01:42.090

Reputation: 4 102

1VMWare Workstation Pro 12 does expand the disk to full size, unfortunately. – Lebenita – 2015-08-27T23:59:17.903

1-c and -z were advertised in 1.51 exactly the other way around (whether that was just an error in the description or the functions were also reversed I don't know). The 1.61 way makes a lot more sense, obviously. – Lebenita – 2015-08-28T00:01:47.083

Just checked with Windows 2012 and a new 20GB VHDX file. The -z option was very fast (seconds) and the VHDX disk file didn't increase in size. The -c option is running much slower and the VHDX is increasing in size. So -z is the preferred option for a so-called thin/expanding virtual hard disk especially if you've over committed disk space. But it's not as safe as the -c option – munrobasher – 2015-12-10T14:07:04.763

1Just checked the latest version (2.0) and there are two obvious differences. Firstly there is a 32-bit and 64-bit version (sdelete.exe & sdelete64.exe). But there is also a subtle difference in the -c command which worries. In v1.61, the -c option said "Cleaning free space" but in v2.0 it says "Zeroing free space". The -z option also says zeroing. Has it lost the random data option?? – munrobasher – 2017-01-17T17:38:20.547

@munrobasher: just downloaded version 2.0 and it seems identical to the post. -z writes 0x00 and -c does something else, which it calls "clean". – Thomas Weller – 2017-01-17T19:05:54.270

I have a log captured where sdelete v1.61 with -c option says "Cleaning free space". However, when I try it now, it says "Zeroing free space" with both options. As does sdelete64 v2.00. Very confused! – munrobasher – 2017-01-23T09:47:37.697

Later - it starts off saying "Zeroing free space" but must change at some point as it now says "Cleaning free space... 32%" – munrobasher – 2017-01-23T22:57:30.417

It won’t bloat the file if the software is somewhat intelligent. Most virtualization applications are. I just tried it in VMware Fusion, it did not increase the file size at all. – Daniel B – 2014-05-01T13:11:59.170

7

Current documentation (and program version 2.01):

  • -c: Clean free space. Specify an option amount of space to leave free for use by a running system.
  • -z: Zero free space (good for virtual disk optimization).

But in older versions it was reversed:

  • -c: Zero free space (good for virtual disk optimization).
  • -z: Clean free space.

enter image description here

But what do they do?

Clean creates the largest file it can, and fills it with random data, and then fills it with zeros. This is what most people think of as wiping, and it's overkill.

The downside is that if you are using a virtual disk, or inside a virtual machine, or running it on a storage space: the underlying storage system will be forced to allocate resources to hold you random data, and then hold zero. Hopefully then the underlying storage system will realize that all that space that was just allocated to your drive can be reclaimed because all those sectors simply contain zeros.

-z Zero: Simply writes zeros to all sectors. This is the option you want, for many reasons:

  • wiping with random data is overkill (reading data is not practically possible; i.e. one bit at a time though a microscope is not feasable)
  • some SSDs can detect that you are writing zero to a sector, and can use that to mark the sector as free (similar to a TRIM)
  • most virtual storage systems (VMWare, Hyper-V, Windows Virtual Disks, Storage Spaces) realize that you are writing an entire sector of zeros, and take the opportunity to reclaim space in the underlying storage file
  • SSDs won't know that your ultimate goal is essentially a glorified TRIM, and (like the virtual disks) be forced to fill sectors that already contained zeros, with non-zeros, only to have you fill it with zeros again. That's terrible for your SSDs.

Source: Mounted a virtual hard disk, and watched the I/O operations that sdelete took in both modes.

tl;dr: Use -z Zero. It's faster, better, safer.

Ian Boyd

Posted 2014-04-30T06:01:42.090

Reputation: 18 244

-c is useful for military grade wiping (DOD 5220.22-M) on a physical mechanical drive – Caltor – 2020-02-27T09:47:19.797

6

This should have been more appropriately posted as a comment to Thomas' answer, but since I cannot do that yet, I post it here.

Mixing up the "-z" and "-c" options is probably a "common mistake", because SDelete has changed the behavior of said options over the years. Looking at the below provided references it seems that SDelete first had a "-z" option which did the "military standard wiping", then added a "-c" option for zeroing free space, and then somewhere between v1.51 and v1.61 switched that behavior to the current one.

References: sysinternals.com Forum and old SDelete homepage on Microsoft TechNet via archive.org.

LN2

Posted 2014-04-30T06:01:42.090

Reputation: 96

This is not an answer to the original question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post.

– DavidPostill – 2014-12-03T16:45:04.900

4This is not an answer to the original question. Please reread the first line of the post though. If there is a better procedure for adding useful and/or pertinent information to an already existing answer for someone, who just signed up to the service, feel free to enlighten me. – LN2 – 2014-12-06T20:37:43.200

"If there is a better procedure for adding useful and/or pertinent information to an already existing answer for someone, who just signed up to the service, feel free to enlighten me" - there isn't, please read the links I provided. – DavidPostill – 2014-12-06T21:43:50.900

It's interesting to note in 1.61 regardless of which switch you use it always says "Zeroing free space" (and in 1.51 it always says "Cleaning free space"). That's a bit misleading, for a while it made me distrust that "-c" was actually "clean" and not "zero" behavior. – rkagerer – 2016-07-30T22:55:32.283