Due to a bug in Windows 10 and 11, version 21H2, personal files remain after resetting a PC. Rudy Ooms discovered the problem and immediately reported it on Twitter.
Rudy Ooms, Microsoft MVP, discovered a serious security vulnerability in Microsoft’s operating programs. The discovery is important for anyone looking to safely resell or dispose of a PC.
Windows makes it easy for these individuals by including under the System Restore via Settingsgiving the option Reset this PC. Click on Getting Started and choose Delete All.
According to the operating system, this erases all personal files, apps and settings. Only this does not appear to be the case in practice.
Personal data readable
Ooms discovered that the Delete All feature does not leave a desktop spick and span. The system still contains the user’s personal data, housed in a folder called Windows.old. More importantly, the personal information can be found in the folder without encryption. That’s because Windows removes Bitlocker when resetting a PC.
The bug is only in version 21H2 of Windows 10 and 11, where it does not matter whether a “Remote Wipe” or a “Local Wipe” is performed. All personal data does get deleted if the system is running version 21H1.
Microsoft has yet to fix the problem. The discoverer of the bug has already created a PowerShell Script of his own. This script ensures that the system no longer contains personal data after a full reset.