The “Mysterious” Cipher Command
After a recent Wednesday Newbytes post, we received several questions about the cipher command.
The Cipher command has been around as long as Windows and is still an available command in Windows 10 and Windows 11.
When you delete files or folders, the data isn’t removed from the hard drive. Instead, the space on the disk that was occupied by the deleted data is deallocated. After it’s deallocated, the space is available to use when new data is written to the disk. Until the space is overwritten, you can recover the deleted data using data recovery software.
So, simply put, when you delete something on your computer, it’s still there until the disk space occupied by whatever you deleted is overwritten by something else. Until that space is overwritten, the data you deleted is easily recoverable.
You can use the cipher command to overwrite the space that was occupied by deleted data thus making it unrecoverable. You can use the cipher command to overwrite deleted data on an entire drive or directory. The cipher command does not delete, change, or affect undeleted data. So, you can run the cipher command without affecting the undeleted data in directories or drives.
To overwrite all deleted data on an entire hard drive, type CMD into the taskbar search and press enter when you see Command Prompt appear.
To overwrite all deleted data on the C: drive, use the command:
CIPHER /W:C \TEST
The spaces in the command must be included. W:C means overwrite deleted data on drive C:\. If you want to overwrite deleted date on drive E:\ then the command would be CIPHER /W:E \TEST
To overwrite deleted data in a specific directory use the example command below. You can substitute the directory name in which you want to overwrite all deleted data. Below we’re overwriting deleted data in the Documents folder. You can substitute any directory name (folder name) instead of Documents.
CIPHER /W:DOCUMENTS
Remember…any files or folders you delete in Windows are not deleted, they ca1 still be recovered until the space occupied by those files and folders is overwritten. If you want to make all your deleted files and folders unrecoverable, you can use the Cipher command to overwrite all deleted data.
NOTE: The Cipher command can take a very long time to complete – sometimes more than 12 hours depending on the size of the drive, the speed of the computer, the amount of free space to be overwritten, and the number of background programs. So run the Cipher command when you’re not planning on using your computer for a while – like while you’re sleeping…
Hmm … in your text, there is a space between the C and \TEST but in the screenshot it appears there is no space. Should there be a space or not?
Also, you don’t explain the “test” aspect. In normal command line parlance, C:\TEST would indicate a directory called TEST. If I were to copy and paste your command, would it go looking for a directory called TEST? Or is TEST a separate command? Actually, now I see that your example does not include the colon after the C, although it is there in the screenshot. Maybe you entered a space instead of a colon by accident?
This is a really cool tool which I was unaware of until I read this, so thanks for that. I hope you can clear up these questions. Thanks!
You are incorrect. The command in the article is CIPHER /W:C \TEST
If you copy and paste that into a command prompt it executes correctly
I don’t mind being incorrect. But can you explain why the article states the command is
CIPHER /W:C \TEST
but the screenshot shows
CIPHER /W:C:\TEST
Are the space and colon interchangeable?
So you switched out the screenshot to match the example in your article, rather than admitting I had a valid question. That’s called gaslighting, right? Cool, cool….
Yes, I concur – the commands shown are correct. I copied and pasted CIPHER /W:C \TEST directly from the article and ran Cipher. Thanks for posting this article. Larry G.
Worked for me too. I used to use this command in Windows XP and forgot all about. Using Win 11 and the command still works. The command is cipher /w:c \test … i think the complainer was confused by the all caps which makes it look as if there is a space between the backslash and the word Test \TEST . Commands are not case-sensitive though.
Should a person do this before they do a factory reset to donate a computer?
If you’re not sure who you’re giving it to it might be a good idea.
I don’t know what SB is complaining for. Both the commands shown work. Some people love to nitpick and find fault, even when nothing’s wrong!
How is this a complaint? It’s a simple question. Nitpick? The text clearly says “The spaces in the command must be included.” So when that particular space is not shown in the screenshot, it’s confusing – especially when you know that a space or no space means everything to a computer.
It’s very curious that someone can’t ask a simple question without being attacked, even on what I thought was a user-friendly site.
Mike’s comments are his own and have nothing to do with Cloudeight. As long as comments are not nasty, profane, degrading, or abusive we do not censor them.
Hi,
This is Susan Poston. If you have time and can go to https://www.hp.com/us-en/shop/pdp/hp-laptop-15z-ef100-touch-optional-8ze47av-1?utm_content=S2R2C1%208ZE47AV_1&jumpid=em_con_nc_ns&aoid=3105023101&utm_medium=em&utm_source=sf&rid=2C281527ABE0660C4914CA1F0C5DF2BE&test=&jobid=3105023&emailid=80462 and look at this laptop computer that I am thinking about buying at tell me if you think it is a good deal and if I need to change any specs on it? At my age I am beginning to think I need a little more help in buying a computer. I want a laptop so I can take it with me when I go places. If you don’t have time I will understand.
Thank you
Susan
Hi Susan. If you’re not going to use it for gaming or intensive graphics work, it should be fine. It has a low-end AMD processor and a small (128 GB) SSD, but it does have 8GB of RAM and the computer comes with Windows 11. For $300, it looks like a good deal for the money.
Do you need the \Test part? If so, what’s the difference between the following two commands?
CIPHER /W:C \TEST
CIPHER /W:C
I ask because some sites don’t show including \TEST but just show using the command line CIPHER /W:C while seeming to describe it doing the same thing, overwriting all the free space on the hard drive so that vestigial data from deleted files that are merely unindexed can’t be recovered, like if you’re donating the computer and don’t want whomever gets it to be able to access data you thought you deleted but is actually still there but just unindexed., but “seeming” isn’t always the way things actually are.
You seem well-versed in the way things actually are, so I want to know if there’s a difference between these two commands and, if so, what that difference is, please.
Thanks. And thanks for your article.
There is no difference. The older command has /test after it. The updated one does not. And it doesn’t matter which you use.
Do you need the \Test part? If so, what’s the difference between the following two commands?
CIPHER /W:C \TEST
CIPHER /W:C
No it’s the old command, both commands do the same thing.
Hello, i run the command yesterday afternoon and it s still in progress after about 24 hours. My laptop has 512 gb memoery.
I used this command because i wanted to sell my laptop.
Can i interrupt the process now because the buyer asks me to send the laptop?
At least, some of the deleted files are already encrypted?
Thank you
No laptop I know of has 512 GB of Memory. Are you sure you don’t mean you have a 512 GB solid state drives. If you run other programs or other programs are running it will take a long, long time to run the Cipher command. Besides the cipher command does not delete files from your computer, it only overwrites already-deleted data so it cannot be recovered. The way to remove all data from a computer including wiping the hard drive is not to use the cipher command but to use Windows Reset as follows:
Type RESET in the taskbar search press Enter when you see “Reset this PC” appear.
Click on “Get started” under the “Reset this PC” section.
Choose the option “Remove everything”. This will erase all your data and reinstall Windows.
You’ll be presented with the option to “Change settings”. Here you can choose:
Data erasure: Select “Wipe the drive” for a more secure reset that takes longer.
Reinstall option: Choose “Local reinstall” for a faster reset that uses existing downloaded installation files.
Confirm the settings and click “Next” to begin the reset process.
Your PC will restart and begin the reset and re installation of Windows. This process can take several hours since this will remove everything, then overwrite your hard drive with gibberish so nothing can be recovered, and then reinstall Windows so the new owner can set up the PC the way he or she wants, and none of your data will be recoverable.
Thanks a lot for your answer, great stuff.
I have an ideapad flex 5 from lenovo, i checked and the hard drive says 512 gb.
I already deleted my files but i wanted to run the cipher command because some are sensitive (legal stuff, cases etc).
I will stop the cipher command window and i will do as you say.
Thanks for you help i will keep visting your site, didnt know it until now.
WIll this command leave the recovery drive intact to be used for reinstall?
This laptop was given to me many years ago and I was always afraid of formating because I do not have install disks.
Using the Cipher Command is not the same as formatting.It leaves every drive intact. It does not delete any data, it just overwrites deleted data with gibberish so it cannot be recover. When you delete a file it’s not really deleted. Windows marks the space occupied by the file you delete as available to use, but the file you deleted remains on your drive (any drive) until it’s overwritten with something uses the space that was occupied by the deleted file. Cipher command does not delete any data that was not already deleted. It just overwrites the space that deleted files occupied so data cannot be retrieved by data recovery or forensics software.