Secure delete files on Windows 11 so nothing can bring them back

What a normal delete actually does

When you press Delete, Windows moves the file to the Recycle Bin, which is a folder like any other. Shift+Delete, or emptying the bin, skips that step but still only marks the file's clusters as free. The data stays where it was, readable by any undelete tool, until Windows writes new data over it. On a drive with plenty of free space that can take a long time, and the file name usually survives in the file system index as well. Securely deleting a file means overwriting those bytes on purpose before the entry is removed.

The manual way: cipher /w and SDelete

Option 1: cipher /w wipes free space, not a file

1. Delete the file the normal way and empty the Recycle Bin. cipher cannot target a file that still exists.
2. Right-click Start and open Terminal (Admin).
3. Run the command below, naming any folder on the drive you want cleaned.

cipher /w:C:\Users\<you>\Documents

Microsoft's reference for cipher describes /w as removing data from the available unused disk space on the entire volume. The folder you name only tells cipher which volume to wipe, and every other parameter is ignored. It works, but it has to fill all of the free space on the drive, so on a large half-empty disk it runs for a long time, and it does nothing for a file you have not deleted yet.

Option 2: SDelete overwrites a specific file or folder

SDelete is Mark Russinovich's Sysinternals tool, published by Microsoft. Download the zip from the SDelete page on Microsoft Learn, extract it, open a terminal in that folder and run one of these:

sdelete -p 3 C:\Users\<you>\Documents\contract.pdf
sdelete -p 3 -s C:\Users\<you>\Documents\OldClient
sdelete -c C:

-p sets the number of overwrite passes (the default is 1), -s recurses into subfolders, and -c cleans the free space on a drive. Microsoft states that SDelete implements the DoD 5220.22-M clearing standard and that it renames a file 26 times before deleting it, so the name is overwritten as well as the contents. One limit the page is open about: it securely deletes file data, but not file names that are already sitting in free disk space.

The SSD caveat, which applies to every tool including Seqtrix

On an SSD the drive's controller spreads writes across flash cells to even out wear, a technique called wear levelling. When you overwrite a file, the new bytes may land in a different cell while the old cell keeps the original until the drive gets around to erasing it. No software overwrite can address those cells directly, so on an SSD treat any overwrite as strong cleanup rather than a guarantee. The real protection is to encrypt the whole drive so that leftover cells hold ciphertext, and to keep TRIM on so the drive erases freed blocks. Check TRIM with:

fsutil behavior query DisableDeleteNotify

Microsoft's fsutil behavior reference explains that a value of 0 means delete notifications, which is TRIM, are enabled, and that NTFS has them on by default unless an administrator turned them off.

The Seqtrix way: Secure Delete with 1, 3 or 7 passes

Seqtrix is a Windows automation app with a built-in security toolkit, so secure delete is a step you drop into a sequence rather than a command you have to remember. There are two ways in.

From template

Open Templates in Seqtrix, search for Shred the temp files and sign out, then choose Use template (click the card). The sequence reports how many files are sitting in your temp folder, securely overwrites the whole %TEMP% folder, clears the Recent list, both jump-list caches, the DNS cache and the clipboard, writes a confirmation to a shred.txt report on your Desktop, then signs you out. It was built for a shared or company PC at the end of a session. It is a Pro template ($9.99 per 30 days, paid once, no subscription); on any other plan, build the same thing with the steps below.

Or build it in four steps

1. 1
   Install Seqtrix

   Download Seqtrix v0.16.0 for Windows 10 or 11. Every install includes a 15-day trial of the Advanced plan, with no card and no account needed to begin.

2. 2
   Add a Security Lock step and choose Secure Delete

   Create a new sequence, drop in a Security Lock step and pick Secure Delete as its action. Choose whether the target is a file or a folder.

3. 3
   Pick the target and the pass count

   Browse to the file or folder. Choose Quick (1 pass), Standard (3 passes) or Thorough (7 passes). Save the sequence.

4. 4
   Run it, or let a trigger run it

   Click Run for a one-off shred, or attach a hotkey, a schedule, an idle trigger or an app-close trigger so it runs without you.

What happens under the hood

Each pass overwrites the file from the first byte to the last, alternating random data, all ones and all zeros, and flushes the write to disk before the next pass starts. Folders are walked and every file inside gets the same treatment before the folder itself is removed. The overwrite is irreversible: there is no undo and no vault copy, which is the point.

One thing SDelete does that Seqtrix does not do today: SDelete also renames the file repeatedly so the original name is overwritten. Seqtrix overwrites the contents and then deletes the entry, so a file name can remain in the file system index. If the name itself is sensitive, rename the file to something bland before you shred it.

FAQ

Keep going

• Template: Shred the temp files and sign out
• Template: Decommission this machine (inventory, backup, shred the personal folders, encrypt the rest)
• Seqtrix vs Windows Task Scheduler: why a scheduled shred is one step here and a script there
• Password-protect a folder on Windows 11