File Shredding vs Deleting: What DoD and Gutmann Actually Do

What delete actually does on NTFS

When Windows deletes a file, two small things change: the Master File Table record is marked free, and the file's data clusters go back on the free-space list. The bytes themselves stay exactly where they were — a deleted document sits on the platter until something else happens to claim those clusters. Recovery tools like Recuva or PhotoRec work precisely because of this: they read raw sectors and rebuild files Windows has "forgotten". The practical consequence is uncomfortable: a drive you sold or donated still carries every file you ever deleted, as long as nobody wrote over it. On an SSD, though, TRIM changes the game — within minutes, the controller returns trimmed blocks as empty to any read request, making recovery effectively impossible without chip-off lab work.

The standards, from three passes to thirty-five

Shredding means overwriting those bytes with other data before marking them free, and the classic standards differ only in how many times they do it. DoD 5220.22-M, the US Department of Defense baseline, specifies three passes — zeros, ones, random — plus a verification read; the 7-pass variant piles on extra passes for media leaving especially paranoid environments. Gutmann's 35 passes were derived in 1996 for MFM- and RLL-encoded drives, a way of writing bits that modern drives abandoned two decades ago; against a drive bought this century it is pure ceremony, as the paper's own author has said. NIST's current guidance, SP 800-88, considers a single overwrite pass sufficient for modern HDDs — anything beyond that buys time, not security.

• DoD 5220.22-M — three passes (zeros, ones, random) plus verify; the sensible default
• DoD 7-pass — same idea, extra passes; theater for modern drives
• Gutmann 35-pass — written for 1990s MFM/RLL encoding; meaningless today
• NIST SP 800-88 — one overwrite pass is enough for modern HDDs
• TRIM on SSDs — plain deletion already defeats recovery tools
• cipher /w:C: — Windows' built-in free-space wipe, three passes, HDD territory

The honest recipe per situation

Selling or donating an HDD: wipe the whole drive, not individual files — one pass is enough, and a full-disk wipe is faster than shredding a used partition piecemeal. Sensitive files on a working HDD: shredding is legitimate, and tools like File Shredder or BleachBit's overwrite mode do it correctly. On an SSD, don't shred anything: overwriting individual files doesn't reliably reach the physical cells anyway, and TRIM already handled the exposure — the right protection is BitLocker from day one, so the drive's contents are noise to anyone without the key. Selling an SSD: BitLocker on, files deleted, Reset this PC with the "clean the drive" option. The one habit worth keeping everywhere: before a drive leaves your hands, ask what's recoverable, not what's deleted.

Questions and Answers

Read next