The “Mysterious” Cipher Command
After a recent Wednesday Newbytes post, we received several questions about the cipher command.
The Cipher command has been around as long as Windows and is still an available command in Windows 10 and Windows 11.
When you delete files or folders, the data isn’t removed from the hard drive. Instead, the space on the disk that was occupied by the deleted data is deallocated. After it’s deallocated, the space is available to use when new data is written to the disk. Until the space is overwritten, you can recover the deleted data using data recovery software.
So, simply put, when you delete something on your computer, it’s still there until the disk space occupied by whatever you deleted is overwritten by something else. Until that space is overwritten, the data you deleted is easily recoverable.
You can use the cipher command to overwrite the space that was occupied by deleted data thus making it unrecoverable. You can use the cipher command to overwrite deleted data on an entire drive or directory. The cipher command does not delete, change, or affect undeleted data. So, you can run the cipher command without affecting the undeleted data in directories or drives.
To overwrite all deleted data on an entire hard drive, type CMD into the taskbar search and press enter when you see Command Prompt appear.
To overwrite all deleted data on the C: drive, use the command:
CIPHER /W:C \TEST
The spaces in the command must be included. W:C means overwrite deleted data on drive C:\. If you want to overwrite deleted date on drive E:\ then the command would be CIPHER /W:E \TEST
To overwrite deleted data in a specific directory use the example command below. You can substitute the directory name in which you want to overwrite all deleted data. Below we’re overwriting deleted data in the Documents folder. You can substitute any directory name (folder name) instead of Documents.
CIPHER /W:DOCUMENTS
Remember…any files or folders you delete in Windows are not deleted, they ca1 still be recovered until the space occupied by those files and folders is overwritten. If you want to make all your deleted files and folders unrecoverable, you can use the Cipher command to overwrite all deleted data.
NOTE: The Cipher command can take a very long time to complete – sometimes more than 12 hours depending on the size of the drive, the speed of the computer, the amount of free space to be overwritten, and the number of background programs. So run the Cipher command when you’re not planning on using your computer for a while – like while you’re sleeping…
Hmm … in your text, there is a space between the C and \TEST but in the screenshot it appears there is no space. Should there be a space or not?
Also, you don’t explain the “test” aspect. In normal command line parlance, C:\TEST would indicate a directory called TEST. If I were to copy and paste your command, would it go looking for a directory called TEST? Or is TEST a separate command? Actually, now I see that your example does not include the colon after the C, although it is there in the screenshot. Maybe you entered a space instead of a colon by accident?
This is a really cool tool which I was unaware of until I read this, so thanks for that. I hope you can clear up these questions. Thanks!
You are incorrect. The command in the article is CIPHER /W:C \TEST
If you copy and paste that into a command prompt it executes correctly
I don’t mind being incorrect. But can you explain why the article states the command is
CIPHER /W:C \TEST
but the screenshot shows
CIPHER /W:C:\TEST
Are the space and colon interchangeable?
So you switched out the screenshot to match the example in your article, rather than admitting I had a valid question. That’s called gaslighting, right? Cool, cool….
Yes, I concur – the commands shown are correct. I copied and pasted CIPHER /W:C \TEST directly from the article and ran Cipher. Thanks for posting this article. Larry G.
Worked for me too. I used to use this command in Windows XP and forgot all about. Using Win 11 and the command still works. The command is cipher /w:c \test … i think the complainer was confused by the all caps which makes it look as if there is a space between the backslash and the word Test \TEST . Commands are not case-sensitive though.
Should a person do this before they do a factory reset to donate a computer?
If you’re not sure who you’re giving it to it might be a good idea.
I don’t know what SB is complaining for. Both the commands shown work. Some people love to nitpick and find fault, even when nothing’s wrong!
How is this a complaint? It’s a simple question. Nitpick? The text clearly says “The spaces in the command must be included.” So when that particular space is not shown in the screenshot, it’s confusing – especially when you know that a space or no space means everything to a computer.
It’s very curious that someone can’t ask a simple question without being attacked, even on what I thought was a user-friendly site.
Mike’s comments are his own and have nothing to do with Cloudeight. As long as comments are not nasty, profane, degrading, or abusive we do not censor them.
Hi,
This is Susan Poston. If you have time and can go to https://www.hp.com/us-en/shop/pdp/hp-laptop-15z-ef100-touch-optional-8ze47av-1?utm_content=S2R2C1%208ZE47AV_1&jumpid=em_con_nc_ns&aoid=3105023101&utm_medium=em&utm_source=sf&rid=2C281527ABE0660C4914CA1F0C5DF2BE&test=&jobid=3105023&emailid=80462 and look at this laptop computer that I am thinking about buying at tell me if you think it is a good deal and if I need to change any specs on it? At my age I am beginning to think I need a little more help in buying a computer. I want a laptop so I can take it with me when I go places. If you don’t have time I will understand.
Thank you
Susan
Hi Susan. If you’re not going to use it for gaming or intensive graphics work, it should be fine. It has a low-end AMD processor and a small (128 GB) SSD, but it does have 8GB of RAM and the computer comes with Windows 11. For $300, it looks like a good deal for the money.
Do you need the \Test part? If so, what’s the difference between the following two commands?
CIPHER /W:C \TEST
CIPHER /W:C
I ask because some sites don’t show including \TEST but just show using the command line CIPHER /W:C while seeming to describe it doing the same thing, overwriting all the free space on the hard drive so that vestigial data from deleted files that are merely unindexed can’t be recovered, like if you’re donating the computer and don’t want whomever gets it to be able to access data you thought you deleted but is actually still there but just unindexed., but “seeming” isn’t always the way things actually are.
You seem well-versed in the way things actually are, so I want to know if there’s a difference between these two commands and, if so, what that difference is, please.
Thanks. And thanks for your article.
There is no difference. The older command has /test after it. The updated one does not. And it doesn’t matter which you use.
Do you need the \Test part? If so, what’s the difference between the following two commands?
CIPHER /W:C \TEST
CIPHER /W:C
No it’s the old command, both commands do the same thing.