Cipher.exe /w Used to Overwrite Free Space (Anti-Forensics)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects the use of the native Windows utility cipher.exe with the /w flag executed from the command prompt. The /w switch instructs cipher to remove data from available unused disk space, which is a technique often used by threat actors to hinder forensic recovery of deleted files.