Examkin

Question

Difficulty: MediumMicrosoft Command-Line Tools

A desktop technician needs to ensure that previously deleted sensitive files on an NTFS volume (drive D:) cannot be recovered using forensic tools. Active files currently stored on drive D: must remain intact and accessible. Which command-line utility and switch combination should the technician execute?

  1. cipher /w:D:Answer
  2. B
    format D: /p:2
  3. C
    shred -z -u D:
  4. D
    sfc /scannow /offbootdir=D:\

Answer

The technician should run cipher /w:D: to overwrite unallocated disk space without affecting existing active files.
Running cipher /w:D: causes Windows to overwrite all unallocated space on drive D: with zeroes, ones, and random data. This permanently prevents forensic recovery of deleted files without modifying or removing active files currently stored on the drive.

Step-by-Step Solution

1
Determine the administrative requirement
Permanently sanitize unallocated space containing deleted sensitive files on volume D: while keeping active data untouched.
Standard deletion leaves file data in unallocated clusters until overwritten, creating a data security risk.
2
Select the appropriate native Windows command-line tool and flag
Execute cipher /w:D:
The /w switch of the cipher utility overwrites all deallocated space on the targeted drive in three passes (zeroes, ones, and random numbers).

Key Concept

Sanitizing unallocated disk space using the Windows cipher /w command
Rate this question

Topics

Microsoft Command-Line Tools

More questions from this topic