Examkin

Question

Difficulty: MediumMicrosoft Command-Line Tools

A technician is sanitizing a local volume on a Windows 11 workstation after sensitive files were manually deleted. To comply with corporate privacy requirements, the technician must overwrite all unallocated disk space to prevent data recovery from deleted clusters, while preserving all existing active files on the drive. Which of the following commands should the technician execute from an elevated command prompt?

  1. cipher /w:C:Answer
  2. B
    format C: /p:1
  3. C
    sfc /scannow
  4. D
    dd if=/dev/zero of=/dev/sda

Answer

The command 'cipher /w:C:' should be executed to overwrite all unallocated disk space on the C: drive without altering existing files.
The 'cipher /w:C:' command specifically targets and overwrites unallocated disk space on the specified volume. This permanently removes residual data left behind by deleted files while leaving all current active files untouched.

Step-by-Step Solution

1
Identify the administrative requirement
Unallocated space containing deleted files needs to be securely wiped while keeping active system and user files intact.
Standard file deletion in Windows only removes pointers to data clusters, leaving recoverable data in unallocated space.
2
Select the appropriate native Windows command-line utility and switch
The 'cipher' tool with the '/w' switch is designed specifically to wipe available (free) space on NTFS or FAT volumes.
Executing 'cipher /w:C:' writes zeroed data, ones, and random numbers across unallocated clusters on the target directory or drive.

Key Concept

Windows Command-Line Utilities - Cipher /W Wiping Unallocated Space
Rate this question

Topics

Microsoft Command-Line Tools

More questions from this topic