Professional's Domain

Ever since Windows Vista, Microsoft introduced a new /P switch for the famous FORMAT command. The /P switch zeros each bit in the volume a certain number of times. This function is very useful when you have sensitive data (such as privacy or classified content) on the disk for security consideration.

As you know, when a file is deleted (even with Shift-delete or with recycle bin emptied) in Windows, it is simply marked with “DELETED”. However, the sectors on which the file was stored remain unchanged until they are allocated for another file AND that file stores some content on them. As a result, it is often possible that “permanently deleted” files in Windows could be recoverd with professional software or devices (such as Undelete and EasyRecovery).  Most of those products also have the ability to recover files from formatted volumes.

This problem is critical when the data is sensitive. The best way to really destroy sensitive data permanently is to force to fill in the sectors storing the data with other content SEVERAL TIMES. Note that some advanced devices are able to recover data even after written with other content one or two times by analyzing the slight difference of magnetic bits on the disk to estimate their previous status.

The /P switch of the format command fills each sector of the volume with zero. the usage is:

format vol /P:passes

vol is the drive letter or mount point of the volumn to format, and passes is a positive integer indicating the number of times the volumn will be filled. Top classified data may require 3 or even more filling passes. Format with /P switch is usually much slower than a regular format. Formatting a 40G volume with 1 filling pass may take more than 20 minutes.

Note that /P is ignored when /Q is specified. So the following command will NOT zero the sectors:

format vol /Q /P:passes

Also note that FORMAT requires elevated privilege. So stat cmd with “Run as administrator” to perform the format.