Although the disk space used by deleted files is marked as free space, deleted files remain intact until new data is written over them. As a result, deleted files can be recovered. You can use Disk Utility to erase the free space used by deleted files by having zeros written over the space once, 7 times, or 35 times. Add, delete or erase APFS volumes in Disk Utility on Mac. Apple File System (APFS) allocates disk space on demand. When a single APFS container (partition) has multiple volumes, the container’s free space is shared and can be allocated to any of the individual volumes as needed. Select Disk Utility in the macOS Utilities window. Click on the Continue button at the bottom right. Step 3: Erase Your Data. How to wipe Mac (format Macintosh HD) in Disk Utility: Look for your startup disk in the left panel under Internal. It is named Macintosh HD by default unless you changed it.
Everyone knows that when you delete a file in Windows it is first moved to the Recycle Bin. When the file is deleted from the Recycle Bin it is not completely gone but the space on the drive occupied by the file has been marked as available to be overwritten. That means the file’s data is still there and can actually be recovered using free data recovery software until it is overwritten by something else.
There are some dedicated tools to permanently wipe or shred the files to prevent them from being recovered as they are deleted. However, once the file has been emptied from the Recycle Bin, Windows does not offer a simple way to restore it back so the file can be shredded. Over time, the amount of data still readable from previously deleted files can become huge.
The image above shows a deleted sensitive file is still viewable in a Hex editor. A good way around this is to use a free utility that is able to make all recoverable data unrecoverable. This is done by erasing only the space on your drive that is not currently occupied by existing files. Once that is done, old data can no longer be seen or recovered. Here’s a selection of 10 free tools to securely wipe free disk space.
1. Eraser
Erase is a well known and popular tool to permanently and securely wipe data. This includes wiping files, folders, drives, partitions, secure file moving, and wiping empty space. It’s a bit more complicated to run a simple wipe in Eraser than other tools because it works on the basis of schedules and you have to create a schedule to do anything.
Run the program, right click in the Erase Schedule box, and select New Task. Click the Add Data button, select the “Unused disk space” from the “Target type” drop down, select the “Erasure method”, then choose the drive from the list and click OK twice. A new task is added to the schedule, Right click and select “Run Now” to start the task. Different drives or different wipe algorithms will require different schedules.
If you leave the erase method on default for any drive wiping functions it will perform a random data single pass erase. This can be changed in the Settings to something different if you have a favorite method. There are 12 separate erase algorithms to choose, including a single pass of zeros or random data, 2 pass GOST, 3 pass DOD, 7 pass VSITR, and the 35 pass Gutman method.
2. Hardwipe
Hardwipe is a well known and fully featured tool for erasing files or wiping drives before they are given to or sold to other users. One of its functions is to clean the free space of drives using several different wiping methods. Hardwipe has to be installed as the portable version went payware some years ago. There’s also an ad for the paid version in the main user interface although it’s not overly intrusive.
Select “Free space” from the left side icons and then you can select one or more drives to have their free space wiped. There are seven cleaning methods; 1 pass zero fill, 1 pass random data, 2 pass GOST R 50739-95, 3 pass DOD 5220.22-M, 7 pass VSITR, 7 pass Schneier, and 35 pass Gutmann. The RAZER methods are only available in the paid version.
There’s also a drop down menu for logging off or shutting the computer down on completion. The speed option is useful if you are wiping a partition’s space while using another partition on the same physical drive. This will intentionally slow down the wiping speed to make the drive more responsive.
3. Sysinternals SDelete and Raymonodcc Free Space Wiper Frontend
SDelete is by Microsoft owned developer Sysinternals. The program is command line only and can also be used to securely erase files as well as wiping available drive space. The two wiping methods available are filling the free space with zeros or a DOD 5220.22-M erase that fills the space with zeros, ones, then random data. Open a Command Prompt or PowerShell window and type the command.
SDelete -c C:
SDelete -p 2 -z C:
The top command runs the three pass DOD method (-c) on drive C, use any drive letter you need to. The bottom command performs the zero fill (-z) but also uses the optional passes argument (-p) to run the pass twice. The zero fill option is useful and often recommended for zeroing virtual hard disks for optimization.
Raymonodcc Free Space Wiper Frontend
SDelete is not difficult to use but many users prefer not to deal with Command Prompt or manually typed commands. As a result, we created a small tool to accomplish the task. It’s portable and simple to use and requires SDelete.exe to work. For best results place SDelete(64).exe in the same folder as the tool, in the Windows folder, or in the System32 folder. Otherwise, you will be asked to locate the executable.
Mac Disk Utility Erase Free Space Free
All you have to do is select the drive to clean from the drop down, select the three pass clean or the zero method, and press the run button. You can also increase the number of passes but remember the Clean option already runs a triple pass algorithm. The program runs SDelete in a console window with the required arguments.
You’ll notice the tool has two tabs, one for SDelete and another called Cipher, more information can be found for that tab on page two of this article. Free Space Wiper Frontend is only 35KB in size and requires .NET Framework 4 which is in Windows 10 and 8 by default. Any useful feedback you have can be left in the comments.
4. CCleaner
CCleaner is probably the most famous Windows junk file cleaning utility around. It also offers a function called Drive Wiper to securely erase entire drives or the free space on your drives. Go to Tools > Drive Wiper, and make sure “Free Space Only” is selected for the wipe option. Then select the overwrite method and finally the drive(s) that you want to wipe.
The CCleaner Drive Wiper has 4 wiping techniques which are 1 pass zero, 3 pass DOD 5220.22-M, 7 pass NSA, and the 35 pass Gutmann method. Simply press Wipe and you’ll get a progress bar with an estimated time to completion. CCleaner comes as a portable version or a setup installer.
5. Hard Disk Scrubber
Disk Scrubber is from 2011 and is a very simple tool to operate with a nice and clean user interface. In addition to free space cleaning, the program can also securely erase files and folders. Disk Scrubber has a rather novel feature of letting you create your own erase algorithm along with your own custom writing pattern.
For simple free space wiping, all you have to do is select the drive from the list, choose the erasing method, and click “Scrub Drive”. The built in methods are Normal 1 pass random data, Heavy 3 pass (equivalent to DOD 5220.22-M), Super 5 pass, and Ultra 9 pass (essentially three DOD 5220.22-M passes and verify). However, the last option of Custom is the most interesting.
Click Edit and a new window opens where you can create your own erasing method. Enter the patterns you want to use in the bottom text box in the order they are to be used. Zeros, ones, checkerboard, random, and a custom pattern can be used in any combination. Type your own text into the top text box for the custom pattern. The image above uses zeros, “NOTHINGTOSEEHERE!”, then random for a three pass erase.
12Next › View All You might also like:
10 Free Tools to Permanently Delete Files and Prevent Data Recovery8 Tools to Wipe a Hard Drive Before Selling or Lending It10 Tools to Find and Remove Duplicate Files Freeing Up Hard Disk Space6 Ways to Safely Remove Windows XP Update Backup Files to Free Up Hard Disk Space4 Ways to Change Windows System Restore Disk Space UsageI use Xorin and i recommend you to try this because all is for free and this software have many methods to erase data permanently. xorin.eu
In the past i used Eraser and Hardwipe and they work fine but in my opinion Xorin is better now.
As far as I can see, Xorin does not wipe free space and only does a full drive erase. So, it’s completely useless for the purposes of what we are trying to achieve here.
ReplyIt’s because of other type of software! But it’s great. You can erase many drives at the same time.
Reply“The more passes that you select, the lower in chances of recovery…”
Not exactly, if you’re talking spinning-platter (non-SSD) drives.
A single pass overwrite, if completed successfully, provides zero chance of recovering the file through any means available to the public. Adding more passes affects nothing but possibly the user’s feelings of security. It’s basically superstition. Gutmann wrote a paper about 15 or 20 years ago, about how in theory overwritten data could be recovered. It’s never once worked in real-world recoveries in the civilian world, even in a lab setting, and drive tolerances are exponentially tighter since then. It’s conceivable that some government agency might have access to extremely expensive equipment that might be able to recover data that isn’t randomly overwritten a few times, but it’s unlikely, and such a recovery method wouldn’t be available to regular law enforcement or for subpoenas. Unless your drive is suspected to have data that poses an urgent threat to national security, one pass is fine, use a 3-pass if you’re paranoid though.
There have been reports of overwritten data being recovered but in all reported cases that we have investigated, the data was not actually overwritten.
SSDs are different. They have a pool of rotating sectors so you’d want to do multiple overwrites. That’s another topic.
I’m not saying I know everything there is to know about this, but I have worked at the oldest and largest data recovery company in the world for over 21 years and we’ve done thousands of recoveries for government agencies and the military, so I have some experience with what can be recovered.
ReplyIn actual fact, we link to the Gutmann paper in another article. In it, he says “a few passes of random scrubbing is the best you can do” when summing up. So even he suggests at least 2 passes wouldn’t be the worst idea (we don’t know exactly how many he meant by “a few”). So, up to a point “The more passes that you select, the lower in chances of recovery…” is not inaccurate according to Mr. Gutmann.
ReplyI use PrivaZer and highly recommend it
ReplyNo mention of Darin’s Boot & Nuke, better known as DBAN?
I’m sure that this project has been around before this article was written, simply image the desired drive, run either a DOD (3 pass or NSA (7 pass) wipe to the drive while at work or sleep (Guttman is offered, yet even he himself stated was overkill & no more effective than a 7 pass), or both if the drive is large enough. All that’ll be left is garbled data randomly spewed across the drive during the last pass, reinstall the backup image & you’re good to go. Just make sure to clean the Temp folders really good before back & restore.
If running a SSD, it’s much faster, inside of 5 minutes on a 2TB model, use the Parted Magic (2013 edition) from Major Geeks, boot from the ISO & be sure to select ‘Internal’ drive (applies to eSATA attached SSD’s also), and avoid the Enhanced Secure Erase, which zaps so many bytes at both ends, decline & choose the Full one & takes no time. I always perform 2x for good measure, then as above, restore my backup image & good to go. A refreshed SSD will run nearly as good as new again!
Cat
ReplyDBAN is not mentioned here because it doesn’t do what we are talking about in this article, which is erasing the free space on your drive while leaving all the visible files intact. DBAN wipes drives completely and leaves nothing behind. We have another article for talking about that, in which DBAN and Parted Magic are mentioned.
raymond.cc/blog/wipe-your-hard-disk-before-lending-or-giving-away/
ReplyI used the default Windows Cipher command on a 300GB external 2.5″ drive connected via USB 3.0, and gave it to the local Sheriff’s Office Cyber Crime unit, which was able to partially/mostly recover a very large number of graphic files that had been on the drive. They were NOT able to recover any of the more than 100gb of music files in a usable form.
To be clear, they DID start with a list of the filenames that had been wiped. The Deputy commented on my collection of photos of SeaCraft boats, calling it “Boat Porn”. The Program they were using is called R-Studio, and is supposedly effective on modern drives of under 1TB capacity, on a variable scale. The greater the drive density, the more difficult to recover securely deleted data.
I plugged the drive back into my laptop at home, and copied all the previously deleted files back to the portable drive, and then ran CCCleaner with the 7-pass option. LEO were still able to get file fragments, including a few discernible images.
The last time I ran Eraser with the Gutmann option. It took 27 hours to run the Gutmann processs on this external 2.5″ drive connected via USB 3.0 to a Lenovo Ideapad w/ 2nd gen. i7 Windows 8.2 laptop with 16gb of RAM. Afterwards, LEO was unable to retrieve any usable data within 48 hours using their normal automated process.
Were those recoverable images originaly stored in JPG format? (compressed format)? or were they in BMP, RAW,.. (some other uncompressed format)? I suposo music was in mp3 (compressed) so it was difficult to retrieve with missing pieces of information.
Reply
@Frank thank you for this information
Reply@Frank – At first I didn’t really believe your claim that the files were recoverable. I mean if the data is overwritten, then it shouldn’t be recoverable. I was directed to this site because I discovered that an external drive I use for a lot of projects had all the previously deleted data easily recoverable. Since I didn’t want to install anything else on my machine I used the built-in Cipher command also. Well, after 3 passes, every file that was recoverable before was just as recoverable after. It’s as if the tool did nothing. Based on your comments I’m going to try Eraser next. Thanks for the heads up about Cipher.
ReplyI Agree with you. Gutman etc advanced cleaners has any sense only on low capacity rotated disks. With high capacity disks and ssd’s this is non sense, because there are no practical way for reading not overwritten data from track borders on rotated, and flash cells are completly overwritten without any possibility with reading any previous data. of course ssd’s should be trimmed, and firmware will automatically wipe out all freed blocks. then only one pass is really needed. hard earsing is needed only, when we have any problem with any “security agency’ :)
Replyhow about R-Wipe and clean or pc tools privacy guardian
ReplyThis is a list of FREE tools, neither of those you mention are free. Privacy Guardian was also discontinued several years ago.
ReplyAnother option is or was Drive Scrubber by Iolo you have to buy their software for it to work But they just took the wipe free space option out making it useless. I used them for 3 years with no problem until they took the wipe free option out.Now all they have is the options to completely erase data,and why pay for that when the data can be erased for free.There wipe free option had 2 ways of cleaning,you could either sweep the drive or do it by overwriting the space and would not leave your drive with overwritten files.
ReplyAny recommendations for something similar to wipe Linux systems of any free storage. I have several Terabyte drives that I need to do this too.
ReplyGaaaaah every ****ing program wants to fill the drive with random data WHY? zeros are better, I want to compress the drive image, random is the worst option possible.
ReplyZeros are not better in terms of security, it’s well known to be way harder to recover data that’s been overwritten with random data as opposed to all zeros. With non random erasing it is easier to recover the data underneath.
ReplyHal9000: The density of modern hard drives makes it impossible to recover data from any overwriting. A single pass of 0x00 is fine to prevent recovery of the overwritten data. A couple of years ago there was a company who said they could recover data from an overwritten hard drive. They got offers from several data recovery companies who each pitched in lots of money for the company to prove its claim. They took a 500 GB drive with a known set of files, wiped it with a single pass of 0’s and gave them as long as they needed to recover a single file from this drive. Several years later they still haven’t recovered a single byte of data (they actually gave up a while back and admitted they weren’t talking about hard drives). If you are going to recover any sectors from a wiped hard drive it will have to be the translated sectors from the G-list that had data on them before they were marked as bad. That’s the only way.
ReplyThank you for the information, it would have been handy if you could have provided a link as if it’s proven a single zero pass is more than enough, then the article may need updating.
I guess it also depends on what is considered a “modern” hard drive, is 160GB modern? Is 40Gb modern? Is 10GB modern? The man behind the rather excessive 35 pass method, Peter Gutmann, recommends 1 or 2 passes of random data is about the best you can get to make data unrecoverable on drives made since 2001/2002.
ReplyModern hard drives for the purpose of this discussion would be considered drives that use PMR technology (perpendicular magnetic recording). Most hard drive manufacturers switched from the previous technology (longitudinal recording) to perpendicular recording between 2006-2009. So it is manufacturer and model specific. There is a study (Overwriting Hard Drive Data: The Great Wiping Controversy link.springer.com/chapter/10.1007%2F978-3-540-89862-7_21?LI=true) if you want a link to more information.
In that case you can’t really recommend a single zero pass unless it is known exactly what brand the hard drive is and whether it falls into the category you mention. At least a random pass can be used across the board (according to Peter Gutmann it’s good for drives made after 2001) without intimate knowledge of your own hard drive.
I have a plain jane Win 7 computer. I hate to be negative but Eraser does not work completely. I can still find and recover long deleted files. ActiveKillDisk reports damaged volumes that are not damaged. Moo0 Anti-Recovery does almost nothing, majority of deleted files are still recoverable. The problem with most of the wiping programs is that they do not completely overwrite all the actual empty space and the file name storage. ShredIt provides a bogus Trial software that actually does nothing, you have buy it to really try it and if it doesn’t work there is a restocking fee if you return it.
I need a program that will completely and definitively wipe/erase all deleted files and free space.
ReplyEraser is packaging dirty baggage now
ReplyNice article. I partcularly appreciate the comments like those in the last paragraph for Eraser. Where known, a little more detail on what is included would be useful (e.g., Moo0 Anti-Recovery itself is particularly clear on what is included). Two other tools to consider:
PrivaZer – a suite similar to CCleaner; can zero freespace with other options for master file table (MFT), etc.
SDelete – one of the many Sysinternals utilities; overwrites a file, directory, or freespace; for free space it zeros (-z) or cleans (-c) (overwrites thrice — 0, 1, random); for free space, the MFT is included but filenames may remain(!); clear, brief explanation of what it does and why but description of options could be a little clearer.
Mac Disk Utility Erase Free Space Online
ReplyThank you!
How To Erase Free Space Disk Utility
Reply