cipher.exe

cipher.exe displays and changes the EFS encryption state of files and directories. Its other notable mode is /w, which overwrites the free space on a volume, the space where deleted files still physically live, so that previously deleted data cannot be recovered. The genuine binary lives at C:\Windows\System32\cipher.exe.

Legitimately, cipher is used to manage EFS or to securely clear deleted data before disposing of a drive. The mode it runs in is what gives an instance meaning.

cipher.exe is used for destruction and anti-forensics (T1485). cipher /w overwrites the free space on a volume, which permanently destroys the remnants of deleted files and defeats file-recovery and carving. Run outside a genuine drive-decommission, especially alongside other cleanup like event-log clearing or shadow deletion, it points to an attacker erasing evidence or destroying data.

Because cipher is a legitimate EFS and disk-hygiene tool, the mode and the context are what matter. A /w wipe issued by a script host in the middle of an incident is very different from an administrator clearing a disk before retiring it.