How can I secure erase a drive using Powershell?

Question

Does Powershell have a built-in way to secure erase a disk? By secure erase, I mean writing random data or all zeros to the entire disk. By disk, I mean the whole physical disk, not individual files, mounted volumes or filesystems.

I found Clear-Disk, but that appears to simply wipe the volume information from the partition tables.

I know there are third-party utilities out there, and Microsoft's own diskpart clean can do the trick, and heck, one could even drop into Linux on Windows and use shred or dd to make the data take a dirt nap...

But can pure vanilla Powershell do it? (without resorting to a complex script or external library call)

Answer 1

There are things you can do in PowerShell to effectively secure data on your disk, depending on your need to erase/dispose/recycle a drive. Unfortunately there is no easy Erase-Disk -Secure cmdlet.

The ATA "SECURE ERASE" and "SANITIZE" commands can be sent to the storage device controller and are usually your best technological bet for quickly and securely erasing an entire disk. However, Microsoft's AHCI driver blocks these commands unless you're running in a WinPE environment. No software running in normal Windows installations can pass ATA commands. https://docs.microsoft.com/en-us/windows-hardware/drivers/storage/security-group-commands

You could probably build a WinPE environment that ran a powershell script to send ATA commands, but then you might as well use a bootable dban image instead.

A solution you could automate using PowerShell from within Windows is BitLocker. Command BitLocker to encrypt either used disk space or all disk space via the GUI or PowerShell, and once encrypted, your data is non-recoverable without the BitLocker key.

https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10

You could also try the built in reset feature of Windows 10 in "recycle" mode which does a secure erase of the onboard storage. I wasn't able to find documentation on automating the process, and only saw systemreset -cleanpc mentioned. I'll update my answer if anybody can find the documentation on automating this.

Answer 2

SDelete
I used sdelete utility (free to download from Microsoft).
This command is cleaning the free space on my D: drive (non-SSD) as I type this answer:

sdelete -c D:

You could download and unzip in Powershell. However I find sdelete is important to have handy (e.g. to delete a sensitive backup file) and recommend installing it on any workstation.

Note also the -c option only cleans free space.

To properly wipe an SSD (which may recycle unallocated space to reduce wear) as drive D:...

1. Allocate the entire disk (no unallocated space)
2. sdelete -c D: (Erase free space)
3. sdelete -s D:\* (Recursively erase all files)

Naturally, it's far easier to erase just the sensitive files instead of doing an entire SSD (after non-securely deleting a sensitive file).