I forgot to shred a file before deleting it (on Windows). How do I shred that part of file system now where the file was located?

First of all (just to be on the safe side) verify the file isn't in the Recycle Bin. If it is, choose Restore and of course shred the recovered file (or maybe you can shred it while inside the Recycle Bin).

If the file has been "truly deleted", recover it using an undelete tool such as Piriform's Recuva, then shred it for good.

Note (suggested by Chris H): deletion under most filesystems is lazy, i.e. the space occupied by the file is simply marked as reusable. Until it is actually reused, the old data is still there and may be recovered. Undelete tools can work in two ways: they can mark that space as occupied again, or they can read the space and make a copy elsewhere. You want the first kind of undeletion, since you want to make the original space accessible to the shredder and destroy it -- not make a copy that will leave the original space still maybe recoverable again and again.

A deleted file might be recoverable using Windows Shadow Copy, which is available since XP and enabled by default in Windows 7+. In an earlier edit I wrote 'chances are that it is disabled'. I should have written "on an unrelated note, ensure that it is disabled". VSS will not help you to shred a deleted file, since (as Chris H noticed) it will actually make another copy. You do not recover the original file space, which remains unshredded. For this reason, your company's IT admins should have disabled VSS on your computer. Otherwise, any "shredded" file may actually have several unshredded and recoverable copies lying around the disk.


DIY overwrite

However: a newly copied file (with VSS disabled) would be at the beginning of the free space area. If you copy a couple thousand files having the same size of the filesystem cluster size (or 1K if you're in doubt), you should be pretty sure that the file has been made unrecoverable even if it has not been "officially shredded".

"Official" overwrite tools

If you really want to be sure use a tool such as SDelete and tell it to wipe the disk's free space (be careful - not the allocated space!). Or you can use Piriform's CCleaner and do the same thing from the Tools menu. Another tool I just discovered by chance, and is recommended by Gutmann himself, is Eraser.

Unless the disk is carefully examined with an electron scanning microscope, nobody's ever going to be able to tell whether the file was shredded with the mandated tool or not before becoming totally irretrievable. If you use SDelete or such in so-called "secure" mode (aka Gutmann erase), even an electron scanning microscope will be none the wiser. Mandatory point: Gutmann erase is serious overkill even in Gutmann's own opinion.

(The above may of course not apply if the company shred executable keeps and possibly transmits a record of the MD5 of every file it shreds).


This can be accomplished with a native Windows tool called cipher.

cipher.exe has existed in Windows systems since Windows 2000, for the purpose of file encryption, but it has a switch that allows for the wiping of all free space on the specified volume. See my original question and answer over at SuperUser for how it accomplishes it and the required syntax.

enter image description here