PM How to Use Microsoft SysInternals SDelete Command

Contents of this Topic: Show

Overview

SysInternals is a free set of tools from Microsoft which is available for download at their website.

The SDelete command is used to securely delete sensitive data from a computer's hard drive. Simply deleting the file from the operating system's directory does not remove the data from the hard drive until such time as the operating system chooses to write new data in that location.

SDelete overwrites the data in the space allocated by the file being deleted so that even a forensic program cannot retrieve the sensitive data.

Procedure

Exercise caution when deleting files – be sure to double-check the command syntax and file/folder name before pressing Enter.

  1. Download and install Microsoft SysInternals on the workstation.
  2. Copy sdelete.exe to the C:\Windows\System32 folder.
  3. Open a command prompt. (Start > Search > cmd)
  4. To delete the entire folder, type:

sdelete –s –p 7 \\servername\directoryname\foldername

To delete a single file, type:

sdelete –p 7 \\servername\directoryname\filename

For example, to delete a file called “Store A Orders.mdb” you would type:

sdelete –p 7 \\server01\StoreFiles\Store A Orders.mdb

where Server01 represents the name of the server, StoreFile represents the directory, and filename represents the name of the store data file to be wiped from the hard drive. The file extension must be included as part of the filename.

File names with spaces must be surrounded by quotation marks.

The –p 7 switch tells SDelete to make 7 passes over the file to ensure the data is irrecoverable.

The –s switch tells SDelete to include the contents of any subdirectories

The amount of time it takes the utility to run depends on the file size and number of passes, so it may take several minutes to delete larger files.

 

 

Created: 2/21/13

Revised:

Published: 04/13/2016