File Shredding vs Deleting: What Gutmann, DoD and NIST Actually Mean

What ordinary deletion leaves behind

On NTFS, deleting a file normally removes its directory and file-system references and makes its clusters available for reuse; it is not the same as overwriting the file. Data may remain readable until reused, but recovery is not guaranteed. Copies can also exist in backups, snapshots, application caches or other locations. On compatible storage, Windows may send TRIM/UNMAP notifications for freed clusters; these are device hints, not a timed or verified secure-erasure promise.

• Microsoft Learn: Windows delete notifications (TRIM/UNMAP)

DoD, Gutmann and NIST: what the labels mean today

A file shredder tries to overwrite a file's data before releasing it, but that does not necessarily remove copies in snapshots, backups, journals or remapped storage. DoD 5220.22-M is a legacy label used by many tools; NIST notes that DoD removed overwrite specifications from its security manual in 2006, so a software preset is not proof of current government certification. Peter Gutmann's 35-pass sequence was published in 1996 for a range of historical encoding schemes; his later epilogue says the full sequence is pointless for a drive using one encoding. NIST SP 800-88 Rev. 2 (2025) says multi-pass overwriting is unnecessary for its Clear method, which typically uses a single pass on user-addressable storage. The method still has to match the media: ordinary writes cannot reliably reach every flash cell in SSDs with spare areas and wear leveling.

• DoD 5220.22-M — a legacy label; check what a tool actually does rather than treating the preset as current certification
• Gutmann 35 passes — a 1996 sequence for historical encoding scenarios; its author says the complete sequence is unnecessary for modern drives
• NIST SP 800-88 Rev. 2 — a media-sanitization framework; Clear typically uses one overwrite pass, while higher assurance may call for Purge or Destroy
• File shredding on HDD — can overwrite selected logical file data, but may miss copies and does not sanitize the whole device
• SSD and flash — wear leveling and spare cells mean file-level overwriting cannot reliably reach every physical copy; TRIM alone is not verified sanitization
• cipher /w:<folder> — Windows overwrites available unused space across the volume, not just one file; it is not a device-wide sanitize command

• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization
• Peter Gutmann: paper and epilogue on the 35-pass method

Choose a method for the file, drive and risk

For a sensitive file on a working HDD, a reputable overwrite tool may reduce recovery from the file's logical location, but it cannot remove every copy elsewhere. Before a computer leaves your control, sanitize the entire storage device with a method appropriate to its media and risk; use the manufacturer's or operating system's supported procedure and check its outcome. For SSDs, do not rely on per-file shredding or TRIM alone: look for a supported device-level sanitize, secure-erase or reset procedure. Cryptographic erase is an option only when its strict prerequisites are met—for example, encryption must have protected the target data from the beginning and key handling must be trustworthy. Back up what you need first, then sign out and verify the device is ready for transfer.

• NIST SP 800-88 Rev. 2: media-specific sanitization and assurance
• Microsoft Learn: cipher /w overwrites unused volume space

Questions and Answers

Read next