Examkin

Question

Difficulty: MediumMicrosoft Command-Line Tools

An IT support specialist is tasked with ensuring that previously deleted sensitive files on a Windows workstation volume cannot be recovered using forensics tools. The operational files currently on the drive must remain intact, and the volume cannot be formatted. Which of the following command-line utilities and options should the specialist execute?

  1. cipher /w:C:\DataAnswer
  2. B
    sfc /purgecache
  3. C
    shred -u -z C:\Data
  4. D
    secpol.msc

Answer

The command 'cipher /w:C:\Data' is the correct choice because it overwrites unallocated free disk space without erasing active files.
The 'cipher /w' command is specifically designed in Windows to remove data from available unallocated storage space. When run against a path, it allocates memory and writes three passes (zeroes, ones, and random numbers) to all free disk space, ensuring deleted files cannot be recovered while leaving active files intact.

Step-by-Step Solution

1
Identify the administrative requirement.
The requirement demands wiping unallocated/deleted data space while preserving active files on a Windows volume.
Standard file deletion in Windows only removes directory pointers, leaving raw file data in free space until overwritten.
2
Evaluate native Windows CLI disk sanitization tools.
The 'cipher' utility with the '/w' switch (wipe) fills unused disk space with zeroes, ones, and random numbers.
Executing 'cipher /w:<directory_path>' targeted at the volume or folder path safely sanitizes deallocated clusters without affecting active data.

Key Concept

Using the cipher command to wipe unallocated disk space in Windows
Rate this question

Topics

Microsoft Command-Line Tools

More questions from this topic