“Delete All Data” Leaves Sensitive Data in Windows 10 & 11 21H2 – Update

Original post 23-02-2022, 14:54 –

Microsoft’s Dutch MVP Rudy Oums discovered a serious flaw in Windows built-in Disk Cleanup tools, as described on his blog Call4Cloud† If the option to delete all data is used, for example to resell a system, personal data will be retained. The issue occurs with both local and remote wipes, on Windows 10 and 11, version 21H2.

In most cases, a folder called Windows.old remains on the emptied drive, despite the warning that all personal and work data and settings will be deleted. Additionally, Bitlocker encryption is disabled, which means that all data is stored unencrypted. The same goes for OneDrive files that have been chosen to always be kept locally.

Ooms has created a PowerShell script that can fix this problem. If the script is run before the device is reset, the personal data can no longer be found. A ticket has also been opened with Microsoft, so that the error can be officially corrected.

If you want to do a reset or refresh soon, you can also manually delete the Windows.old files afterwards. It is then recommended to use a tool to ensure that the data cannot be found on the disk.

Update 25-02-2022, 19:33 –

Microsoft has confirmed that folders containing local files repair data (application-specific data) from, among others, OneDrive or OneDrive Business are not always properly deleted during a system reset – which may or may not have been performed remotely. The developer is currently working on a fix, in the meantime, users will be able to sign out of OneDrive or unlink their account before a system reset. Anyone who has already done a reset can follow these steps (link) to delete the left data.

Sources:
Tom’s gear† Microsoft

4 products discussed

Compare all products