Does Windows 10's "reset PC and clean the drive" correctly clean the drive?

11

3

I'm resetting my Windows 10 laptop and deleting all my personal files to give it.

When I asked Windows to reset, I found what seems to be a new option : "clean drive", that claims to make data recovery more difficult.

Does this option actually write zeroes on the entire drive to erase previous data ? Does it really prevent anyone from recovering my deleted files ?

Hey

Posted 2015-08-24T07:07:39.777

Reputation: 939

Generally these two options are shown in windows 10. https://msdn.microsoft.com/en-us/library/windows/hardware/dn938307%28v=vs.85%29.aspx

– vembutech – 2015-08-24T07:27:25.513

@vembutech this page don't seems to answer my question, it only lists the options available without mentioning the "Clean the drive" feature, which is proposed after choosing "Reset your PC" – Hey – 2015-08-24T07:38:59.367

Answers

12

When you choose reset your PC you will have the options to "Fully clean the drive" or "Just remove my files". By picking "Fully clean my drive" it will take several hours and it will attempt to overwrite anything on the drive with zeroes, so yes it will. You have to remember there are some companies capable of restoring data from your disk but this will make it a lot harder than a quick format.

If you choose "Just remove my files" it will just do a quick format.

Description from Microsoft:

The behavior of this option will vary depending on if the drive is encrypted with BitLocker.

If the volume is not encrypted, then this option performs a full format of the disk and writes zeroes to every sector. This will take quite a long time. This is similar to running the command below:

format.exe c:\ /P:0

If the volume is encrypted with BitLocker, only a quick format is performed, as that wipes all of the information necessary to decrypt the disk. With no way to decrypt the disk, the data is effectively lost.

Note that this procedure will take much longer than the quick format. It could take hours on a large hard drive. This is not something that you would want to do live with a customer. It would be better to start it and arrange a follow-up later.

Source: http://blogs.msdn.com/b/olivnie/archive/2013/04/05/recovery-and-troubleshooting.aspx

EntMobSec

Posted 2015-08-24T07:07:39.777

Reputation: 577

1Thanks ! For your warning about specialized companies, I will trust the answers to previous questions here saying that a single overwrite is sufficient to prevent any recovery on modern drives. – Hey – 2015-08-24T10:30:12.700

Please see this article where Microsoft confirms my answer: http://blogs.msdn.com/b/olivnie/archive/2013/04/05/recovery-and-troubleshooting.aspx

– EntMobSec – 2015-08-24T12:09:56.513

Thanks for the source :) I quote the relevant passage for those who don't want to read the entire page : "If the volume is not encrypted, then this option performs a full format of the disk and writes zeroes to every sector. This will take quite a long time. This is similar to running the command below: format.exe c:\ /P:0". And @Ramhoud, can you give a source saying that a single overwrite is not enough ? There are other answers on SE that contradicts you. – Hey – 2015-08-25T08:53:50.440

1@YdobEmos - I was indeed mistaken about writing 0's portion of my statement. As for a single pass of writing 0's being enough to restore deleted files, in a case of a SSD that wouldn't be enough, nor would it be enough for a mechanical drive depending on the resources of the person doing the data recovery. – Ramhound – 2015-12-03T16:26:03.550

@Ramhound you seem to be right in the case of SSDs. For mechanical drives, there are several other questions on Information Security that claim that recovery of overwritten bits on modern hard drives is infeasible. – Hey – 2015-12-03T17:14:29.000

@YdobEmos - How infeasible something actually is, would be defined by the person attempting to recover the data, which is the reason encryption is important in our world today. If somebody implements full disk encryption on a drive, it does not actually matter if that encryption is broken, what is on the drive is still random data. Once you delete the data then actual usable data recovery is not possible, because any data that is recovered, is still encrypted. I am half conspiracy nut due to my work history. – Ramhound – 2015-12-03T17:20:59.363