Windows True Hard Format & Clean Reinstall S
Comprehensive, forensic-style, step-by-step guide to securely wipe a drive (HDD/SSD) and perform a
clean Windows install without leaving residues.
Includes: creating official installation media, BIOS/UEFI preparation, disk secure-wipe using
DiskPart, offline OOBE bypass (skip Microsoft account), reinstall, drivers, Secure Boot key reset,
and post-install hardening.
Follow carefully. This guide is intended for legal, owner-controlled devices only. Irreversible
actions (data loss) are included BACKUP any data before proceeding.
Generated guide carry out actions at your own risk. / Authoritative steps compiled for home use.
Prerequisites & Warnings
1) A spare USB drive (8GB or larger).
2) Another working PC with internet to download Microsoft Media Creation Tool and OEM drivers.
3) Backup ALL important files; this process will permanently erase data on the target disk.
4) Ensure power: laptop plugged or desktop on UPS to avoid power loss during operations.
5) Have your Windows license key available if needed (digital license typically tied to hardware).
6) This guide assumes Windows 10/11 modern UEFI hardware. Legacy BIOS steps are similar but may
differ.
Warning: 'diskpart clean' is irreversible. Use only on the intended drive.
Step 1 Create Official Windows USB Installer
1) On a working PC, download the official Microsoft Media Creation Tool from [Link].
2) Run the tool, choose 'Create installation media (USB flash drive)' select language & edition
choose USB flash drive.
3) Wait for the tool to download and write the official installer. Do NOT use unofficial ISO
sources.
4) After completion, safely eject the USB.
Commands / Exact text (copy carefully):
(No command line required use Media Creation Tool GUI)
Tip: Keep the USB labeled: WINDOWS_INSTALLER
Step 2 Prepare BIOS/UEFI
1) Reboot the target PC and enter BIOS/UEFI setup (common keys: F2, Del, F10, Esc vary by
manufacturer).
2) In UEFI settings: set Boot Mode = UEFI (disable legacy/CSM), Secure Boot = ON (you may
temporarily disable for troubleshooting, but enable later), Fast Boot = OFF.
3) If available, reset BIOS to 'Load Setup Defaults' to clear odd settings.
4) If Laptop has Intel ME/AMD PSP firmware options, note them but do NOT change unless you know OEM
guidance.
If you plan to flash BIOS firmware, download OEM update and follow vendor instructions before reinstall.
Step 3 Boot from USB & Reach Installer
1) Insert Windows USB, reboot and open Boot Menu (F12/F11/ESC depending on brand).
2) Select the USB device to boot from. The Windows installer will start.
3) Select language, keyboard and click Next Click 'Install Now'.
4) When prompted for a product key, choose 'I don't have a product key' if your device has a digital
entitlement. You can enter key later.
If USB doesn't show: enable USB boot in BIOS or disable secure boot temporarily to detect USB.
Step 4 Use DiskPart to Fully Wipe the Drive (RE
This step removes all partitioning and metadata from the selected disk EFI, MSR, recovery, hidden
partitions leaving the disk 'raw'.
1) On any installer screen press SHIFT + F10 Command Prompt opens.
2) IMPORTANT: Identify the correct disk number. Using the wrong disk will erase the wrong drive.
3) Commands below will remove partition table (fast, safe for our purposes).
Commands / Exact text (copy carefully):
diskpart
list disk
select disk 0 <-- REPLACE 0 with the correct disk number
clean
exit
Alternative: 'clean all' overwrites every sector with zeros (very slow). Use only if required.
Step 5 Install Windows on Unallocated Space
1) Return to the installer window. Click 'Refresh' if needed to detect the now raw/unallocated disk.
2) Select the Unallocated Space Click Next. Windows installer will create required partitions
automatically (EFI, MSR, Recovery, Primary).
3) Let installation complete. First boot may take several minutes as Windows finalizes setup.
Do NOT connect to the internet during first OOBE if you want to avoid Microsoft account sign-in.
Step 6 Skip Microsoft Account (Offline Setup)
To prevent enforced Microsoft account sign-in during OOBE use the hidden bypass command.
1) At 'Let's connect you to a network' screen press SHIFT + F10 CMD.
2) Type: OOBE\BYPASSNRO and press Enter. System will reboot and then show 'I don't have internet'
option.
3) Choose 'Continue with limited setup' or 'I don't have internet' and create a local account.
4) Finish OOBE without connecting the PC to the internet.
Commands / Exact text (copy carefully):
(SHIFT+F10)
OOBE\BYPASSNRO
Works on Windows 10/11 versions supporting the NRO (network requirements) bypass.
Step 7 Install Official Drivers & First-Hardening
1) After first login (offline), go to the manufacturer's support site on a separate device and
download chipset, storage (SATA/NVMe), LAN/WiFi, GPU drivers on a USB.
2) Install drivers from USB. Reboot when asked.
3) In UEFI, enable Secure Boot and restore default keys (if previously changed).
4) Configure Windows Update, enable firewall, and install latest cumulative updates (connect to
internet only after drivers are installed).
Avoid installing unknown third-party utilities or non-OEM driver packs.
Optional Reset Secure Boot Keys (EFI DBX/PK/S
Some advanced cleaning suggests deleting custom or third-party Secure Boot keys and installing
default platform keys:
1) Enter UEFI setup Secure Boot menu Manage Secure Boot Keys 'Delete All Secure Boot Keys' (or
'Install Default Keys').
2) Save & Exit. This reinitializes the platform's secure boot policy to OEM defaults.
Caution: Some vendors recommend vendor-specific procedures; check OEM docs before changing keys.
Resetting keys may require re-enrollment of corporate PKI or certain drivers signed with custom keys.
SSD Special: Secure Erase / NVMe vs HDD
1) For SSDs, the ideal secure wipe is the manufacturer's Secure Erase tool (Samsung Magician,
Crucial Storage Executive, Intel SSD Toolbox) or NVMe 'sanitize' command.
2) 'diskpart clean' removes partitions but may not cryptographically erase all NAND blocks due to
wear-leveling. Use 'secure erase' if you need absolute data removal.
3) For HDDs, 'clean all' will zero-fill the disk (time-consuming but effective).
If uncertain, performing both 'diskpart clean' + vendor secure-erase is recommended for forensic-grade sanitation.
Post-Install Security Checklist (Do these first)
1) Create a local admin and a standard user account for daily use. Avoid using admin account for web
browsing.
2) Enable BitLocker with a saved recovery key (store offline).
3) Enable Secure Boot and TPM in UEFI.
4) Install anti-malware (Windows Defender) and perform an offline scan.
5) Review Autoruns (Sysinternals) to ensure no unexpected startup entries.
6) Change all important passwords from a clean device and enable MFA on accounts.
7) Keep firmware updates (BIOS/UEFI, SSD, WiFi) up to date via OEM.
For suspected firmware-level compromise, contact OEM or certified forensics lab; replacement hardware may be required.
FAQ & Troubleshooting
Q: Will this remove firmware-level implants? A: This process removes disk and boot partitions;
firmware-level implants (UEFI SPI, Intel ME) require OEM reflashing or hardware service.
Q: I don't see USB in boot menu. A: Ensure USB is formatted FAT32 (Media Creation Tool does this)
and disable legacy mode or enable USB boot.
Q: How to verify disk is clean? A: Boot to a Linux live USB and run 'gdisk -l /dev/sda' or 'lsblk
-f' to confirm no leftover partitions.
Q: I have RAID or multiple drives. A: Repeat 'diskpart clean' for each physical disk (select disk
N).
If unsure at any step, stop and ask but do not proceed if you can't identify the target disk.