Examkin

Question

Difficulty: Very hardMicrosoft Command-Line Tools

A security technician is preparing a storage volume (`D:`) for reassignment. The active, non-sensitive files currently stored on the drive must be preserved, but all previously deleted data remaining in the volume's unallocated free space must be permanently overwritten to prevent forensic recovery. Which of the following commands should the technician execute from an elevated Command Prompt?

  1. cipher /w:D:Answer
  2. B
    format D: /p:2
  3. C
    diskpart (followed by select volume D and clean all)
  4. D
    shred -u -z /dev/sdb1

Answer

Executing `cipher /w:D:` securely sanitizes and overwrites all unallocated free space on the specified volume while leaving active files intact.
The correct command is `cipher /w:D:`. The built-in Windows utility `cipher.exe` when called with the `/w` switch removes data from available unallocated disk space by writing three passes (zeros, ones, and random numbers) over sectors that contain remnant data from deleted files, without affecting any existing active files.

Step-by-Step Solution

1
Identify the operational requirement.
The requirement calls for sanitizing deleted data residing in unallocated disk space without destroying existing active files on drive D:.
Administrative tasks requiring target-specific data erasure without volume reformatting require utility switches designed specifically for unallocated space wiping.
2
Evaluate the native Windows Command Prompt utilities.
The Windows native `cipher.exe` utility includes the `/w` (wipe) parameter designed explicitly to write zero filled data, followed by ones and random numbers, across all available free space on a partition.
`cipher /w:Path` targets only deleted/deallocated sectors, ensuring active files remain untouched.
3
Differentiate from destructive formatting and external OS commands.
Commands such as `format` with `/p` or `diskpart` with `clean all` purge active data, while Linux utilities like `shred` are unavailable natively in `cmd.exe`.
Selecting non-destructive native switches prevents unintended loss of operational data.

Key Concept

Windows Command-Line Utilities (cipher.exe)
Rate this question

Topics

Microsoft Command-Line Tools

More questions from this topic