Deep Clean and Secure Delete on Windows: cipher /w, VSS, BitLocker

To securely delete data on Windows, clean clutter with Storage Sense or Disk Cleanup, overwrite free space with cipher /w, remove old shadow copies only after listing them, and control pagefile.sys and hiberfil.sys. Before you sell or recycle the PC, confirm BitLocker is on, then run Reset this PC with Remove everything and Clean data.

"Deleted" on Windows means different things depending on where the data lives: a file record, a shadow copy, the paging file, a OneDrive recycle bin, or an SSD cell Windows can no longer address. This guide covers each layer using Microsoft's own documentation and built in commands, then maps each step to NIST SP 800-88 Revision 2.

Key takeaways

• Storage Sense and Disk Cleanup free space; they do not securely erase anything.
• cipher /w:C:\ overwrites deallocated space on the whole volume, but on SSDs it cannot reach spare flash cells.
• Shadow copies keep older versions of deleted files. List them before deleting, and know that deleting them is also a ransomware behaviour.
• pagefile.sys and hiberfil.sys can hold anything that was in memory. A policy can clear the paging file at shutdown; powercfg /hibernate off removes the hibernation file.
• BitLocker full encryption from day one turns a reset into a cryptographic erase. Used Disk Space Only enabled later can leave old plaintext in free space.
• Reset this PC with Clean data is the right final step, but Microsoft says it does not meet government or industry erasure standards.
• For a second drive, verify the disk number twice before any wipe.

Why "delete" on Windows does not mean gone

Microsoft's own support article on Cipher.exe explains the core problem in plain terms. When you delete a file, the data "isn't initially removed from the hard disk." The space it occupied is marked as deallocated and becomes available for new writes. Until something overwrites it, the old bytes are still there, and data recovery software can read them.

Emptying the Recycle Bin only deallocates. Even Encrypting File System leaves a plaintext backup copy in deallocated space after it encrypts a file, as Microsoft notes. Windows also keeps copies in other places:

The last row surprises people most. NIST SP 800-88 Rev. 2 states that on flash storage with spare cells and wear levelling, it is "infeasible for a user to sanitize all previous data" by overwriting.

What Storage Sense and Disk Cleanup remove, and what they do not touch

Storage Sense

Storage Sense lives at Start, Settings, System, Storage. According to Microsoft's Storage Sense support page:

• It is off by default, though Windows may turn it on when disk space runs low and tell you.
• With default settings it cleans temporary files when space is low.
• Recycle Bin items are deleted after a period you choose; Downloads are left alone unless you set a period.
• Inactive OneDrive files can become online only. From Windows 11 version 22H2 the default is 30 days.
• It only works on the system drive, and only when you are signed in and have been online for more than 10 minutes.

Making a OneDrive file online only is not a secure delete. The file stays in the cloud and the old local clusters are just deallocated.

Cleanup recommendations and Disk Cleanup

Microsoft's "Free up drive space" page points Windows 11 users to Settings, System, Storage, Cleanup recommendations, which groups Temporary files, Large or unused files, Files synced to the cloud and Unused apps. Windows 10 users get the classic Disk Cleanup tool by searching for "disk cleanup" and choosing "Clean up system files" for more space.

The Previous Windows installation item deserves a warning. Microsoft says removing it "can't be undone" and you will not be able to roll back to your previous version of Windows. That item is the Windows.old folder, and it only appears for a short window after an upgrade.

Disk Cleanup also has a command line form, cleanmgr, which is useful when you want a repeatable cleanup on many machines:

:: Choose categories once and save them as profile 1
cleanmgr /sageset:1

:: Run profile 1 against every drive later (for example from Task Scheduler)
cleanmgr /sagerun:1

:: Remove files left behind after a Windows upgrade
cleanmgr /autoclean

Microsoft's cleanmgr reference lists categories such as temporary setup files, temporary internet files, old Chkdsk files, the Recycle Bin and offline files. For drives other than the Windows drive, only the Recycle Bin and content indexer catalog options are available.

What none of these tools do

None of them overwrite anything. They are housekeeping. They do not make deleted data unrecoverable, and they do not touch shadow copies, the paging file, the hibernation file or your cloud accounts.

What cipher /w overwrites, and where it falls short on SSDs

What Microsoft documents

The cipher command reference describes /w as removing "data from available unused disk space on the entire volume." A few details matter:

• If you use /w, every other parameter is ignored.
• The directory you pass can be any folder on the volume. The command cleans the whole volume, not just that folder.
• If the directory is a mount point or points to another volume, the data on that other volume is cleaned instead.
• Microsoft's support article adds that you should quit all programs first, that "the data is permanently removed," and that it can take a long time on a large amount of free space.

Older guides say cipher /w writes three passes of zeros, 0xFF and random data. The current Microsoft pages we reviewed do not state a pass count or patterns, so this post does not rely on it. NIST SP 800-88 Rev. 2 says multiple pass overwrites gain very little on SSDs with over provisioning anyway.

How to run it

cipher /w does not touch files you can currently see, but it fills the volume while it runs, so close other programs first.

Warning: cipher /w permanently removes any chance of recovering files you have already deleted on that volume, including files you might still want back. Check the Recycle Bin and any recovery tooling first.

Check which volume you are about to scrub:

:: Confirm the drive letter, size and encryption state first
manage-bde -status C:

Then run the overwrite:

:: Overwrite deallocated space on the whole C: volume
cipher /w:C:\

For a data drive, change the letter, for example cipher /w:D:\.

Where it falls short

On a spinning hard disk, overwriting deallocated sectors does what you expect. On an SSD, the controller remaps writes to fresh cells, so zeros written to "free" logical blocks may never land on the cells that held your data. Over provisioned and retired cells are invisible to Windows; NIST says flash devices with spare cells "cannot support directly addressing all areas" where data was stored.

TRIM does part of the job. Windows sends delete notifications (TRIM or unmap) when clusters are freed, and Microsoft's fsutil behavior reference says trim is enabled by default on NTFS unless an administrator disables it. Check it like this:

fsutil behavior query DisableDeleteNotify

A value of 0 means delete notifications are enabled. TRIM tells the SSD a block is unused, but it does not guarantee when or whether the cells are physically erased, so it is not a sanitization method on its own.

The honest conclusion: on an SSD, cipher /w is a reasonable hygiene step for deleted files on an unencrypted volume, but it is not a Purge. Encryption from the start is the control that actually covers SSDs.

The BitLocker alternative: manage-bde -wipefreespace

If a volume uses BitLocker with Used Disk Space Only encryption, Microsoft provides a dedicated wipe:

manage-bde -wipefreespace C:
:: short form
manage-bde -w C:
:: cancel a running wipe
manage-bde -w -cancel C:

Microsoft's reference says running it on a Used Space Only volume "provides the same level of protection as the Full Volume Encryption" method. It is the right tool to close the gap described in the BitLocker section below.

How shadow copies and System Restore keep deleted data

What they are

The Volume Shadow Copy Service takes point in time snapshots of a volume, used for Previous Versions, backup tools and restore points. Microsoft's System Protection page describes a restore point as a snapshot of system files, installed applications, the registry and system settings. System Protection is not enabled by default, and a slider under System Properties, System Protection, Configure caps its disk space.

The privacy problem: if a document existed when a snapshot was taken, its blocks can be preserved in shadow storage after you delete the file and after you run cipher /w, because the snapshot is a separate allocation.

List them first

All of these commands need an elevated prompt.

:: Every shadow copy on the machine
vssadmin list shadows

:: Only the shadow copies for C:
vssadmin list shadows /for=C:

:: How much space shadow storage is allowed to use
vssadmin list shadowstorage

Microsoft's vssadmin reference lists delete shadows, list providers, list shadows, list shadowstorage, list volumes, list writers and resize shadowstorage as available on both client and server Windows.

Delete them safely

Warning: Deleting a shadow copy is permanent. Microsoft's own caution says you lose "any previous versions or restore points that depend on it." Run vssadmin list shadows /for=C: first, read the volume and creation time of every entry, and make sure you have a separate backup on media that is not attached to this PC.

Device path check before you delete:

:: Confirm the exact volume and shadow IDs you are about to remove
vssadmin list shadows /for=C:

Then choose the narrowest option that works:

:: Remove only the oldest shadow copy on C:
vssadmin delete shadows /for=C: /oldest

:: Remove one specific shadow copy (paste the ID from the list output)
vssadmin delete shadows /for=C: /shadow=SHADOW-ID-HERE

:: Remove every client-accessible shadow copy on C:
vssadmin delete shadows /for=C: /all

Only client accessible shadow copies can be deleted this way; Microsoft says others return an "outside of your allowed context" error and need diskshadow.

Why this command makes defenders nervous

Ransomware deletes shadow copies before encrypting files. MITRE ATT&CK lists this as T1490, Inhibit System Recovery, naming vssadmin, wmic shadowcopy delete, wbadmin, bcdedit, REAgentC and diskshadow. Tell your security team before you run it on a managed device, and see our post on MITRE ATT&CK T1490 for how defenders detect it.

If you only want shadow storage to hold less history, lowering the cap with the System Protection slider is less disruptive than deleting everything. BitLocker interacts here too. Microsoft's BitLocker FAQ says shadow copies made before BitLocker was enabled "will be automatically deleted" when BitLocker is enabled on software encrypted drives, and manage-bde -on has a -removevolumeshadowcopies switch to force it.

What lives in pagefile.sys and hiberfil.sys, and how to control them

The paging file

Windows moves memory pages it is not actively using into pagefile.sys. Microsoft's description of the "Shutdown: Clear virtual memory pagefile" policy explains the risk: important information kept in memory "might be written periodically to the paging file," and someone with physical access to a shut down machine could move the drive to another computer and read it.

That policy is at Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options. On client computers its effective default is Disabled. When enabled:

• The paging file is cleared at normal shutdown, and the hibernation file is cleared when hibernation is disabled on a portable device.
• Shutdown takes longer. Microsoft's example, a server with 2 GB of RAM and a 2 GB paging file, "can add more than 30 minutes." Test it on your hardware.
• It does not help if someone pulls the power, as Microsoft notes.

Set it locally in the security policy editor or through Group Policy across a fleet.

On unencrypted systems, fsutil behavior set encryptpagingfile 1 encrypts the paging file after a restart, per the fsutil behavior reference.

The hibernation file

When a PC hibernates, Windows writes memory to hiberfil.sys so it can resume. That file can contain open documents, session tokens and anything else that was in RAM. powercfg controls it:

:: Turn hibernation off and remove hiberfil.sys
powercfg /hibernate off

:: Turn it back on
powercfg /hibernate on

:: Use a smaller "reduced" hiberfile that only supports hiberboot
powercfg /hibernate /size 0
powercfg /hibernate /type reduced

Microsoft's powercfg reference describes /hibernate as enabling or disabling the feature and setting the hiberfile size, and notes that a reduced hiberfile only supports hiberboot. Turning hibernation off disables anything that depends on the hiberfile, so expect startup behaviour on some laptops to change.

Microsoft's BitLocker FAQ adds a counterpoint: BitLocker "provides extra security for the hibernate mode," while sleep is weaker because unprotected data remains in RAM. On an encrypted laptop, a sleeping machine in a bag is the bigger risk. The FAQ also says memory dumps are encrypted when BitLocker is on.

How to confirm BitLocker or Device Encryption is on, and why it changes wiping

Check status

:: Status of every drive
manage-bde -status

:: Status of C: only
manage-bde -status C:

:: List key protectors on C:
manage-bde -protectors -get C:

Microsoft's manage-bde -status reference lists the fields you get back: size, BitLocker version, conversion status, percentage encrypted, encryption method, protection status, lock status, identification field and key protectors. The two you care about here are Conversion Status (you want "Used Space Only Encrypted" or "Fully Encrypted") and Protection Status (you want "Protection On").

For scripts, manage-bde -status C: -protectionaserrorlevel returns 0 when the volume is protected and 1 when it is not.

Device Encryption on Home editions

BitLocker management is available on Pro, Enterprise and Education editions. Device Encryption is the automatic flavour that Microsoft says is available on all Windows versions on qualifying hardware. Microsoft's BitLocker overview explains that from Windows 11 version 24H2, the DMA and HSTI or Modern Standby prerequisites were removed, so more devices qualify. It also explains a detail that matters for anyone who resets or sells a PC:

• After setup, the drive is encrypted with a clear key, which is equivalent to BitLocker being suspended.
• The clear key is removed only after a recovery key is backed up to Microsoft Entra ID, Active Directory, or the Microsoft account of an administrator on the device.
• If a device uses only local accounts, Microsoft says it "remains unprotected even though the data is encrypted."

So a local account laptop can look encrypted without being protected. Our posts on whether BitLocker is on by default and on BitLocker versus Device Encryption cover the edition differences in more detail.

Why encryption changes wiping

NIST SP 800-88 Rev. 2 describes cryptographic erase as sanitizing the keys rather than the data, which is far faster than overwriting. Two of its conditions map directly onto Windows:

1. No plaintext was ever stored on the media. NIST says cryptographic erase is only appropriate if no sensitive data was previously stored in plaintext, since it can only sanitize keys for encrypted data. On Windows, that is the Used Disk Space Only problem. Microsoft's BitLocker planning guide warns that when you encrypt only used space on an existing volume, sectors holding earlier unencrypted data "can be recovered through disk-recovery tools until they're overwritten." If you turned BitLocker on years after the drive was first used, run manage-bde -wipefreespace or re-encrypt with full encryption before relying on a key destroying reset.
2. Every copy of the key must be gone. NIST warns that cryptographic erase "should not be trusted" on media whose keys have been backed up or escrowed unless you are confident about where those copies are. With BitLocker, recovery passwords are often stored in a Microsoft account, Entra ID or Active Directory. Microsoft's FAQ notes that recovery password entries in Active Directory are not deleted by design. Before you hand over a drive, decide what happens to those escrowed keys, and see our guide on where to store recovery keys for encrypted laptops.

Device encryption uses XTS-AES 128 by default per Microsoft's overview, which meets the 128 bit floor NIST cites from ISO/IEC 27040 for cryptographic erase.

What "Clean data" in Reset this PC does and how long it takes

Where to find it

• Windows 11: Settings, System, Recovery, Reset PC.
• Windows 10: Start, Settings, Update and Security, Recovery, then Get started under Reset this PC.

The choices

Microsoft's Reset your PC page describes:

• Keep my files reinstalls Windows and removes apps and settings; Remove everything also removes personal files and is the choice for giving a PC away.
• Cloud download fetches a fresh copy of Windows; Local reinstall uses files already on the PC.
• Clean data, under Remove everything, removes files "and cleans the drive," which Microsoft says "makes it harder for other people to recover files you've removed."

How long it takes

Microsoft does not give a time. The page says it "might take some time," the screen may stay black for over 15 minutes, and restarting manually during the reset can cause it to fail. Keep the laptop on mains power and leave it alone.

What it does not claim

Microsoft states that this erasure is aimed at consumers and does not meet government or industry erasure standards. For regulated data, pair it with full BitLocker encryption done in advance and follow your organisation's media sanitization policy.

Before you start a reset with Remove everything:

Warning: Remove everything deletes all personal files on the PC and cannot be undone. Confirm you have a tested backup on separate media, sign out of and deauthorise accounts you can, and record the BitLocker recovery key if you might need to read the drive again before the reset completes.

Microsoft's reset page does not describe including other drives, so treat them with the separate process below.

How to handle a second internal or external drive

Step 1: identify the disk, twice

# Read-only: list disks with number, name, serial, bus type and size
Get-Disk | Format-Table Number, FriendlyName, SerialNumber, BusType, Size, PartitionStyle

# Read-only: show which drive letters live on which disk
Get-Partition | Format-Table DiskNumber, PartitionNumber, DriveLetter, Size, Type

Match the number to the serial and size on the drive's label, unplug every other external drive, and list again right before any destructive command.

Step 2: choose a method

Option A, full encryption, then reformat. Encrypting the whole volume with BitLocker (not Used Space Only) rewrites every block, including old free space, as ciphertext.

:: Device path check: confirm D: is the drive you mean
manage-bde -status D:

:: Full volume encryption with a password protector (no -usedspaceonly)
manage-bde -on D: -pw

Microsoft's manage-bde -on reference says that if -usedspaceonly is not specified, "all used space and free space on the volume will be encrypted." On removable drives, standard users can manage BitLocker; on fixed drives you need to be an administrator, per the BitLocker FAQ.

Option B, clear the whole disk. For a drive leaving your control permanently, zero it.

Warning: The next block erases every partition and every byte on the selected disk. There is no undo. Re-run Get-Disk and confirm the number, serial and size before you continue.

diskpart
:: inside diskpart
list disk
select disk 2
detail disk
clean all
exit

Microsoft's diskpart clean reference says clean all sets "each and every sector on the disk" to zero, and that a disk must be selected first. Plain clean without all only overwrites partitioning information, which is not a wipe.

PowerShell's Clear-Disk -Number 2 -RemoveData is described by Microsoft as removing partition and volume information, not as an overwrite, so do not treat it as sanitization. Use -WhatIf first if you script it.

On an SSD or flash drive, Option B has the same limits as cipher /w. Option A or the manufacturer's own sanitize tooling is stronger, and physical destruction is the fallback for failed media.

OneDrive Files On-Demand and the cloud recycle bin

Local cleanup does nothing to copies held in the cloud. Microsoft's OneDrive restore page says that for personal accounts you can restore files deleted within the last 30 days, and for work or school accounts within the last 93 days unless an administrator has changed the setting. It also notes that files deleted from the cloud, including online only files, do not appear in your computer's Recycle Bin, but may still be in the OneDrive or SharePoint web recycle bin.

For a sensitive file in a synced folder: delete it locally, then delete it again from the OneDrive web recycle bin, and run cipher /w locally if the drive is unencrypted. In a work tenant, your administrator's retention rules still decide what is truly gone.

Which commands need admin rights, and what can break

Microsoft's BitLocker FAQ states that changing BitLocker on operating system and fixed data drives requires the local Administrators group. Everything else here touches system wide state, so open Terminal with Run as administrator for all of it.

Protect two things before you start. The BitLocker recovery key: Microsoft's FAQ says BitLocker is designed to make the drive unrecoverable without it. And your backups: several steps above destroy the copies that would otherwise save you after a mistake.

A complete walkthrough: deep clean, then hand over

This is the sequence for a Windows laptop you are about to sell, donate or reassign. Each command is explained, with its warning, in the sections above.

1. Back up and verify to separate media, and open a few files from the backup to prove it works.
2. Export what you need later: the BitLocker recovery key, licence keys, and sign out of password managers and developer tools. Our post on which files on a developer laptop hold credentials is a useful checklist.
3. Check encryption with manage-bde -status C:. If the drive is unencrypted and you are on Pro or above, turn on full encryption and let it finish.
4. Clean clutter with Cleanup recommendations or Disk Cleanup, and empty the Recycle Bin.
5. Handle shadow copies: vssadmin list shadows /for=C: first, then delete only after the warning above.
6. Scrub free space: manage-bde -w C: on a Used Space Only volume, or cipher /w:C:\ on an unencrypted one.
7. Clean the cloud: empty the OneDrive web recycle bin and remove the device from your Microsoft account.
8. Reset: Settings, System, Recovery, Reset PC, Remove everything, then turn on Clean data.
9. Verify the device lands on the out of box setup screen.
10. Record the date, device serial, method and who did it. Under a compliance framework, that record is your sanitization evidence.

How each step maps to NIST SP 800-88 Clear and Purge

NIST SP 800-88 Revision 2 was published in September 2025 and supersedes Revision 1 from December 2014. It defines three methods:

• Clear sanitizes all user addressable locations against simple, non invasive recovery through the normal interface, for example by overwriting or a factory reset.
• Purge makes recovery infeasible even with state of the art laboratory techniques while keeping the media reusable, using overwrite, block erase or cryptographic erase through dedicated sanitize commands.
• Destroy makes recovery infeasible and the media unusable, for example by shredding, disintegrating or incinerating.

For media specific techniques, Revision 2 points readers to the IEEE 2883 series.

On an SSD, only one row reaches Purge without vendor tooling, and it depends on decisions made at setup time.

Where Safeguard fits, honestly

Safeguard is a software supply chain security platform. It does not erase drives, manage devices, scan for malware or check whether BitLocker is on, and none of the steps above depend on it. The link is narrower: a Windows developer laptop is part of your supply chain. It holds project lockfiles, global package installs, old SDKs and toolchains. When you rebuild a machine after a deep clean or reset, you reinstall dependencies from those lockfiles, and that is the moment old vulnerable versions quietly come back. Running a Safeguard scan of each project on the rebuilt machine, through the CLI or the local runner and offline mode, shows which dependency versions you just pulled and which known vulnerabilities apply, before the rebuilt laptop starts shipping code again.

Common mistakes

• Treating Storage Sense as secure deletion. It frees space. Deleted bytes stay in deallocated clusters until overwritten.
• Running cipher /w on an SSD and calling it wiped. NIST is explicit that overwriting cannot reach all flash locations. Use encryption from the start.
• Forgetting shadow copies. A free space scrub does not touch blocks preserved by a restore point.
• Deleting shadow copies on a managed laptop without warning the security team. It looks like T1490 activity.
• Assuming Device Encryption protects a local account PC. It stays unprotected until a recovery key is backed up.
• Trusting cryptographic erase after enabling Used Disk Space Only on an old drive. Wipe free space first.
• Forgetting escrowed recovery keys. They can still unlock a drive you thought was erased.
• Using diskpart clean without all. It only removes partition information.
• Picking the wrong disk number. Numbers move when USB devices are plugged in.
• Ignoring the cloud. OneDrive keeps deleted files for 30 or 93 days by default.

FAQ

Does emptying the Recycle Bin permanently delete files on Windows?

No. Emptying the Recycle Bin deallocates the space but leaves the data on disk until it is overwritten. Microsoft's Cipher.exe article says recovery software can read deleted data until the space is reused.

How many passes does cipher /w make?

Microsoft's current command reference and support article do not state a pass count or patterns. What they do say is that /w overwrites unused space on the whole volume and leaves existing files alone. NIST says extra passes add little on SSDs anyway.

How do I delete all System Restore points in Windows?

Open an elevated prompt, run vssadmin list shadows /for=C: to see what exists, then vssadmin delete shadows /for=C: /all. Deletion is permanent, so have a separate backup first.

Should I delete pagefile.sys and hiberfil.sys?

You should not delete pagefile.sys by hand. Enable the "Shutdown: Clear virtual memory pagefile" policy instead, or rely on BitLocker. You can remove hiberfil.sys with powercfg /hibernate off, which also disables hibernation.

Does BitLocker make a factory reset secure?

It helps a lot if the drive was fully encrypted from first use and every copy of the recovery key is destroyed or retired. If BitLocker was turned on later with Used Disk Space Only, wipe free space with manage-bde -w first. Microsoft says Reset this PC's Clean data is aimed at consumers and is not a government or industry standard erase.

How long does Reset this PC with Clean data take?

Microsoft does not publish a time. Its reset page says it "might take some time" and that the screen may stay black for over 15 minutes. On large hard disks it can take hours. Keep the device plugged in and do not restart it.

How do I securely wipe an external hard drive on Windows?

Identify the disk with Get-Disk and confirm the serial and size. Then either turn on full BitLocker encryption with manage-bde -on E: -pw and reformat, or use diskpart select disk N followed by clean all to zero every sector. For SSDs and USB flash drives, encryption or the manufacturer's sanitize tool is stronger than zeroing.

Does deleting a file from OneDrive delete it everywhere?

Not right away. It goes to the OneDrive recycle bin, where personal accounts keep it for 30 days and work or school accounts for 93 days unless an administrator changed that. Empty the web recycle bin to remove it sooner, and remember that organisational retention rules may still keep a copy.

Fix it without waiting for upstream

A deep clean or reset ends with a rebuild, and a rebuilt Windows machine pulls every project's dependencies, SDKs and container images down again, often at whatever versions the lockfiles and scripts specify. The fit with secure deletion is indirect, but the rebuild is a natural checkpoint to make sure the code you start shipping from the clean machine is not carrying known vulnerable components.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos erase a drive. They show the software side once a rebuilt machine is back in use. If you want to try the CLI yourself, download it from https://safeguard.sh/download and read the setup guide at https://docs.safeguard.sh/docs/cli .

This first demo is a real CLI session. After install, safeguard opens the interactive terminal, you ask it to fix the lodash CVE in a repo, and it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. On a freshly rebuilt laptop, the same flow is how you catch a vulnerable version that came back in with the first npm install.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code, and then scans from the terminal. After a reset, this is how you get dependency inventory and vulnerability checks working again on the rebuilt machine without moving project code anywhere else.

Click through it at your own pace, or open it full screen.

The third demo shows the desktop app sending work to a computer running the CLI, with each command approved before it runs. On rebuilt team laptops, that keeps a person in charge of what runs.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Microsoft Learn: cipher
• Microsoft Learn: Use Cipher.exe to overwrite deleted data
• Microsoft Support: Cipher.exe Security Tool for the Encrypting File System
• Microsoft Learn: vssadmin
• Microsoft Learn: vssadmin delete shadows
• Microsoft Learn: vssadmin list shadows
• Microsoft Learn: manage-bde
• Microsoft Learn: manage-bde status
• Microsoft Learn: manage-bde on
• Microsoft Learn: manage-bde wipefreespace
• Microsoft Learn: BitLocker overview
• Microsoft Learn: BitLocker FAQ
• Microsoft Learn: BitLocker planning guide
• Microsoft Support: Manage drive space with Storage Sense
• Microsoft Support: Free up drive space in Windows
• Microsoft Learn: cleanmgr
• Microsoft Support: Reset your PC
• Microsoft Support: System Protection
• Microsoft Learn: Shutdown: Clear virtual memory pagefile
• Microsoft Learn: Powercfg command-line options
• Microsoft Learn: fsutil behavior
• Microsoft Learn: diskpart clean
• Microsoft Learn: Clear-Disk
• Microsoft Support: Restore deleted files or folders in OneDrive
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization
• MITRE ATT&CK T1490: Inhibit System Recovery

Last reviewed: 23 October 2026. Windows features and defaults change between versions; check the linked Microsoft pages for the latest behaviour.