How to delete files securely, and why an SSD changes the answer

What deleting leaves behind

The space, not the data. Microsoft explains that when you delete files or folders the data isn’t initially removed from the hard disk: the space it occupied is deallocated, made available for new data. Until something is written over it, the deleted data can be recovered with a low-level disk editor or data-recovery software. In our reading, the same fact is what makes recovering deleted files possible.

Copies you didn’t make. Microsoft adds that when Encrypting File System encrypts a plain file it first makes a backup copy, then deletes it; like any deleted file, that copy stays on the disk until overwritten.

Three methods, in NIST’s terms. NIST’s Guidelines for Media Sanitization, revision 2 of September 2025, sort them into clear, purge and destroy. Clear applies logical techniques to all user-addressable storage locations, through the same interface the user has, for example by overwriting, and protects against simple, non-invasive recovery; purge makes recovery infeasible even with state-of-the-art laboratory techniques while keeping the drive potentially reusable; destroy makes recovery infeasible in the same way and leaves the drive unable to store data. Bending, cutting or drilling a hole through a device, NIST adds, may only partly damage it, leaving portions of it accessible with those same techniques. NIST says purge should be used instead of clear when possible.

What cipher /w covers, and what it doesn’t

Where Microsoft says it applies. The how-to article on overwriting deleted data lists only supported versions of Windows Server under Applies to; the reference page for the cipher command lists Windows 11, Windows 10 and Azure Local as well, and describes /w as removing data from available unused disk space on the entire volume, and when /w is used every other parameter is ignored. Microsoft describes cipher as a tool for NTFS volumes.

Hard disk or SSD. NIST says flash storage with spare cells and wear levelling makes it infeasible for a user to reach all the old data by overwriting, because the drive does not expose all of it through the normal read and write interface, and that on SSDs with overprovisioning such practices should be avoided, because very little confidentiality protection is achieved. NIST does not name cipher; applying this to cipher /w on an SSD is our reading.

Passes. In the past, NIST says, hard drives were often erased with multiple overwrite passes, from a single pass to as many as 39, for example following the Defense Department’s 5220.22-M manual; NIST notes that the department removed overwriting specifications from that manual in 2006. On a Mac, Disk Utility’s Security Options slider sets how many times the erased data is written over, on the storage devices that offer it.

On a Mac

The whole Mac. Apple’s Erase All Content and Settings erases all data, settings and apps and keeps the installed macOS. Apple says these steps erase all of your data from the Mac, and that a backup made first can be used to restore the files to a new Mac. It needs macOS Monterey 12 or later and a Mac with Apple silicon or the Apple T2 Security Chip; the path is Apple menu > System Settings > General > Transfer or Reset > Erase All Content and Settings. On macOS Monterey 12, on a Mac that supports the feature, Apple says to choose System Preferences from the Apple menu, then Erase All Content and Settings from the System Preferences menu in the menu bar. The full route, and what survives it, is in how to factory reset a MacBook.

Why it is quick. Apple’s Platform Security guide, in the chapter on Apple devices with Data Protection, says the encrypted file system key is additionally wrapped by an effaceable key stored in Effaceable Storage or by a media key-wrapping key, designed to be quickly erased on demand by Erase All Content and Settings or a remote wipe, and that erasing it renders all files cryptographically inaccessible. The key that wraps the file metadata key changes every time a user erases the device.

Another drive. In Disk Utility, erasing a storage device deletes everything on it, and Apple marks as important that any files you want to keep are copied to another storage device before you erase; Security Options appear only for some types of device. With an SSD, Apple says secure erase options are not available in Disk Utility, and, for more security, suggests considering FileVault encryption when you start using the drive.

Encryption, and the conditions NIST attaches to it

Cryptographic erase. NIST describes it as a purge technique for storage with integrated encryption, usable under the correct conditions and with strong cryptography: the data is sanitised by sanitising the keys that encrypt it, much faster than other techniques. For cloud storage it may be the only viable purge option.

The conditions. NIST cites ISO/IEC 27040 for the first condition: no sensitive data may have been stored on the drive unencrypted (for a drive already sanitised with an appropriate technique, since that sanitisation), because cryptographic erase can only sanitise keys to encrypted data. In its own words, and not ISO’s, NIST adds that cryptographic erase should not be trusted on drives whose data or keys have been backed up or escrowed, unless there is a high level of confidence in how and where the keys were stored and managed. NIST writes about drives with built-in encryption and does not name FileVault or BitLocker; that the same conditions apply to them, and so favour turning encryption on when you start using a drive, as Apple suggests for FileVault on an SSD, is our reading.

Long-lived secrets. NIST adds that the data still sits on the drive as ciphertext, so for information that must stay confidential for decades, a future weakness in the cryptography is a concern. On Windows, the encryption Microsoft’s Reset your PC page names is BitLocker, whose recovery key it asks for on an encrypted device; where that key is kept is in BitLocker recovery key.