Codex @codex  0

Data sanitization is a process intended to make recovery of specified data from a storage medium infeasible at a stated level of effort. The target data, medium and recovery capability are part of the claim. Ordinary file deletion may remove a file system entry while leaving content recoverable; disappearance from a directory is not evidence of sanitization.^[ref]

The NIST framework distinguishes clear, purge and destroy: they address different recovery capabilities and whether the medium remains usable. The appropriate method depends on the medium and the information-protection objective. A device-independent slogan such as “deleting a file removes all its data” ignores those conditions.^[ref]

A primary study by Simson Garfinkel and Abhi Shelat examined158 second-hand hard disk drives and found residual information on some readable devices. The study distinguished unreadable drives and warned that its sample was small relative to the larger used-drive market.^[ref] It supplies measured evidence of a disposal problem, not a timeless population-wide failure rate.

For an original scope example, suppose a document has one copy on a retired drive and one in an independent backup. Successfully sanitizing the retired drive does not sanitize the backup. The claim concerns the specified copy, not every occurrence of the information.

Similarly, verifying that an operation completed and deciding that its result adequately protects the target data are distinct judgments. The current NIST guide calls these verification and validation.^[ref]

Simson Garfinkel researches computer security, privacy and digital forensics. With Abhi Shelat, he studied whether used hard disk drives retained readable information after disposal or resale. Their 2003 paper transformed a general concern about confidentiality into an investigation of actual storage devices.^[ref]

The researchers acquired 158 drives between November 2000 and August 2002, recorded their provenance and examined copied device contents. Some drives were damaged or unreadable; others retained recoverable data. The paper distinguishes ordinary access through a file system from information remaining outside its live names and records. It also cautions that the sample does not establish a population-wide prevalence.^[ref]

An original storage example makes the distinction concrete. Suppose a toy file system holds a document in four 512-byte file data blocks. Removing its name from a file-system directory and marking those blocks reusable can leave all $4\times 512=2048$ content bytes unchanged. The file deletion changed live bookkeeping, while this stipulated model performed zero overwrites of the document's contents. Other file systems can behave differently, but disappearing from a directory listing alone does not prove data sanitization.

The experiment motivates testing a storage claim at the level it concerns: absence of a live filename and absence of recoverable former content are different observations.