Analysis of the Effectiveness of Data Sanitization Methods on Windows Against Data Recovery Using a Digital Forensic Approach
DOI:
https://doi.org/10.30871/jaic.v10i2.12256Keywords:
Data sanitization, file carving, Windows 10, ACPO, Digital ForensicsAbstract
The growth of Windows 10 usage in Indonesia has made user data security an issue that needs to be considered. The Reset This PC feature provides three data sanitization options, namely Keep My Files, Just Remove My Files, and Fully Clean The Drive. However, the effectiveness of each method in permanently eliminating data has not been widely analyzed using a forensic approach. This study aims to evaluate the effectiveness of the three sanitization methods against the possibility of data recovery using file carving techniques. The research process was conducted using the ACPO forensic guidelines, which consist of Plan, Capture, Analyze, and Present. The disk images resulting from the reset process were analyzed using Autopsy, PhotoRec, and Foremost. Three main parameters used to determine effectiveness were volume, integrity, and functionality. The results show that the Fully Clean The Drive option is the only method that is truly effective, with an effectiveness rate of 0%. Meanwhile, Just Remove My Files still leaves digital artifacts with an average effectiveness of 77.8%, and Keep My Files is the least effective as a data sanitization technique. These findings confirm that Windows users cannot rely on the other two reset methods if the primary objective is to permanently delete data.
Downloads
References
[1] A. Haris, A. Malik, A. N. Safitri, and A. S. Rahma, “Dasar-Dasar Komputer Yang Harus Dimiliki Oleh Masyarakat Dalam Menghadapi Perkembangan Teknologi,” Scientica: Jurnal Ilmiah Sains Dan Teknologi, vol. 2, no. 1, pp. 1–9, 2024, doi: 10.572349/scientica.v2i1.673.
[2] Statcounter Global Stats, “Desktop Operating System Market Share Worldwide.” Accessed: Oct. 09, 2025. [Online]. Available: https://gs.statcounter.com/os-market-share/desktop/indonesia
[3] Statcounter Global Stats, “Desktop Windows Version Market Share Indonesia.” Accessed: Oct. 19, 2025. [Online]. Available: https://gs.statcounter.com/windows-version-market-share/desktop/indonesia
[4] J. Schneider et al., “In Search of Lost Data: A Study of Flash Sanitization Practices,” May 2025, [Online]. Available: http://arxiv.org/abs/2505.14067
[5] E. J. Lee, S. Y. Lee, H. Kwon, S. J. Lee, and G. B. Kim, “Identification of data wiping tools based on deletion patterns in ReFS $Logfile,” Forensic Science International: Digital Investigation, vol. 46, p. 301607, Oct. 2023, doi: 10.1016/j.fsidi.2023.301607.
[6] A. Ardiansyah, D. S. Djoha, M. Z. Ardiansyah, and E. S. Eriana, “Penerapan Tools Autopsy Untuk Recovery File Pada Windows,” Jurnal Ilmu Komputer (JIK), vol. 7, no. 1, pp. 66–71, 2024.
[7] R. N. Dasmen, A. Triwulanda, R. Rasmila, D. Kurniawan, and J. Julia, “Implementation of Digital Forensics Photorec in Recovering Lost Files on External Storage,” PIKSEL : Penelitian Ilmu Komputer Sistem Embedded and Logic, vol. 12, no. 1, pp. 173–178, Mar. 2024, doi: 10.33558/piksel.v12i1.9444.
[8] K. A. Dahlan, A. Yudhana, and H. Yuliansyah, “File carving Analyze of Foremost and Autopsy on external SSD mSATA using the Association of Chief Police Officer Method,” ILKOM Jurnal Ilmiah, vol. 16, no. 3, pp. 283–295, Dec. 2024, doi: 10.33096/ilkom.v16i3.2360.283-295.
[9] M. Halsey, “Installing and Restoring Windows 11,” in Troubleshooting and Supporting Windows 11: Creating Robust, Reliable, Sustainable, and Secure Systems, Springer, 2022, pp. 651–670.
[10] P. C. Sethi, “File Carving: Analyzing Data Retrieval in Digital Forensics,” International Journal of Computer and Information Technology, vol. 13, no. 3, pp. 2279–0764, 2024, [Online]. Available: www.ijcit.com
[11] B. I. H. Kuswara, A. R. Pratama, and E. Ramadhani, “Studi Komparasi Metode Disk Overwrite dan Factory Reset sebagai Teknik Anti Forensik di Perangkat Android,” JATISI (Jurnal Teknik Informatika dan Sistem Informasi), vol. 9, no. 2, pp. 1151–1161, Jun. 2022, doi: 10.35957/jatisi.v9i2.1955.
[12] M. B. Blankesteijn, A. Fukami, and Zeno. J. M. H. Geradts, “Assessing data remnants in modern smartphones after factory reset,” Forensic Science International: Digital Investigation, vol. 46, p. 301587, Sep. 2023, doi: 10.1016/j.fsidi.2023.301587.
[13] R. A. Andika, N. D. W. Cahyani, and R. G. Utomo, “Testing Tools Data Wiping dalam Kegiatan Anti Forensik,” LOGIC: Jurnal Penelitian Informatika, vol. 1, no. 1, p. 29, Sep. 2023, doi: 10.25124/logic.v1i1.6442.
[14] M. F. Abdillah and Y. Prayudi, “Data Recovery Comparative Analysis using Open-based Forensic Tools Source on Linux,” International Journal of Advanced Computer Science and Applications, vol. 13, no. 9, pp. 633–639, 2022, doi: 10.14569/IJACSA.2022.0130975.
[15] R. R. Syahputra and Y. Prayudi, “Perbandingan Hasil Recovery File terhadap Penghapusan File menggunakan Perintah Sdelete dan Shift+Delete,” AJIE, vol. 09, no. 02, pp. 117–131, May 2025, doi: 10.20885/ajie.vol9.iss2.art5.
[16] G. B. Akintola, “Assessing the Performance of Forensic File Recovery Tools on Deleted Files from a USB Device,” DS Journal of Cyber Security, vol. 3, no. 2, Aug. 2025, doi: 10.59232/CYS-V3I2P101.
[17] J. Matondang, I. Maulana, and Carudin, “Analisis Perbandingan Perangkat Lunak Forensik Digital File Carving Menggunakan NIST,” INNOVATIVE: Journal Of Social Science Research, vol. 3, no. 4, pp. 2154–2165, 2023, doi: https://doi.org/10.572349/scientica.v2i1.673.
[18] J. Williams, “ACPO Good Practice Guide for Digital Evidence,” 2012.
[19] J. Sitima, “Understanding Digital Forensic Tools: Their Features, Applicability and Key Short Comings. A Compendium,” International Journal For Multidisciplinary Research, vol. 6, no. 6, Nov. 2024, doi: 10.36948/ijfmr.2024.v06i06.30026.
[20] H. Syahida Alawi, I. Riadi, and S. Sunardi, “Improving Credibility of Digital Evidence Investigation in E-Commerce Fraud Cases using ISO/IEC 27037,” International Journal of Advances in Data and Information Systems, vol. 6, no. 2, pp. 479–495, Aug. 2025, doi: 10.59395/ijadis.v6i2.1408.
[21] R. Naveen, A. Vijayarajan, K. P. Archana, and S. S. Nidhin, “Recovery of Deleted Files : Challenges and Techniques,” International Journal For Multidisciplinary Research, vol. 7, no. 2, Apr. 2025, doi: 10.36948/ijfmr.2025.v07i02.41088.
[22] I. Ismail and K. Akram Zainol Ariffin, “The admissibility of digital evidence from open-source forensic tools: Development of a framework for legal acceptance,” PLoS One, vol. 20, no. 9, p. e0331683, Sep. 2025, doi: 10.1371/journal.pone.0331683.
[23] J. Schneider et al., “Poor Sanitization Practices and Questionable Digital Evidence: A Comprehensive Study of Scope and Impact of Recycled NAND Flash Chips,” IEEE Trans. Dependable Secure Comput., vol. 22, no. 6, pp. 5970–5984, 2025, doi: 10.1109/TDSC.2025.3579237.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Rara Eka Septya, Agus Wijayanto, Muhammad Fahmi Abdillah, Djumhadi Djumhadi
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License (Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) ) that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
