Applies to: Pro, Enterprise and Audit
Purpose
Free-space wiping writes temporary data into currently addressable unallocated space on a selected volume and then removes the temporary data. It is intended to reduce residual logical content from previously deleted files whose clusters may still be available for allocation.
Standard free-space behavior
CertErase creates a hidden system temporary area and writes cryptographically generated random data until it reaches a reserved free-space threshold. It then removes the temporary objects on a best-effort basis.
To reduce the risk of exhausting the operating system’s working space, the application leaves an approximate reserve:
- 4 GiB on the system drive;
- 1 GiB on other drives.
On FAT32, multiple temporary files are used to remain below the file system’s maximum individual file size.
What users will observe
During the operation, Windows can report that the drive is nearly full. This is expected while temporary wipe files occupy free space. The displayed free-space value should recover after cleanup, although file-system accounting or pending deletion can delay the change. On the system drive, a restart may be required before all space appears available.
Risks and precautions
Free-space wiping can:
- Run for a long time;
- Generate heavy sustained writes;
- Affect application performance;
- Trigger low-disk-space alerts;
- Interact with quotas, snapshots, antivirus, backup agents, and monitoring systems;
- Increase write wear on flash storage;
- Fail to reach space held outside ordinary allocation control.
Do not run it on a production server or critical workstation without an approved maintenance window and tested recovery plan.
Scope limits
Free-space wiping does not guarantee removal of data from remapped sectors, SSD over-provisioned areas, device caches, snapshots, backups, virtual-disk host storage, storage arrays, or cloud-provider replicas.