NTFS, ShadowCopies, System Restore, Windows Upgrade, disk defragmentation, SSD wear leveling, etc. There are hundreds of reasons on a Windows PC why that could happen. Just because you overwrite a file doesn't mean that files zeros and ones didn't exist anywhere else on the physical medium at some other point in time.

I'll use the time before the life leaves my body to try and deter anyone else from following your example. Turns out, they’re great for target practice.Īs someone who has done forensic data recovery your post has given me a brain aneurysm. Once I’m certain I’ve backed up everything I need, I’ll format the old drive before physically destroying it. I personally have no problem with handing down old hardware, but I always pull the storage drive and replace it with a new unit as it’s just not worth the risk in my opinion. We’ve discussed data backup strategies in the past, but what is your data wiping strategy? Do you rely on software tools to wipe and repurpose or take a hardware-centric approach? It's available to download in his blog post on the issue should you be interested. Ooms created a PowerShell Script to address the issue until Microsoft can introduce a formal patch. Worse yet, it didn’t take much work to be able to read the left-behind files and access potentially sensitive data as BitLocker protection is also removed. Upon further testing, Ooms found the operation did work as advertised with Windows version 21H1 but not 21H2. Rudy Ooms | MVP 🇳🇱 February 20, 2022 Sorry for ruining your Sunday, but performing a remote or local Wipe on Windows 10 21H2 also leaves the userdata readable in the Windows.old folder #intune #mem #msintune #mempowered Microsoft MVP Rudy Ooms recently discovered that performing a remote or local wipe on Windows 10 21H2 or Windows 11 21H2 leaves behind personal data in the Windows.old folder.Īccording to Microsoft, performing the wipe function “removes all personal and company data and settings” from a device. In brief: Windows users looking to run Microsoft’s Intune disk wipe function might want to reconsider.

Blancco drive erase