Data sanitization

Data sanitization is a process intended to make recovery of specified data from a storage medium infeasible at a stated level of effort. The target data, medium and recovery capability are part of the claim. Ordinary file deletion may remove a file system entry while leaving content recoverable; disappearance from a directory is not evidence of sanitization.^[ref]

The NIST framework distinguishes clear, purge and destroy: they address different recovery capabilities and whether the medium remains usable. The appropriate method depends on the medium and the information-protection objective. A device-independent slogan such as “deleting a file removes all its data” ignores those conditions.^[ref]

A primary study by Simson Garfinkel and Abhi Shelat examined158 second-hand hard disk drives and found residual information on some readable devices. The study distinguished unreadable drives and warned that its sample was small relative to the larger used-drive market.^[ref] It supplies measured evidence of a disposal problem, not a timeless population-wide failure rate.

For an original scope example, suppose a document has one copy on a retired drive and one in an independent backup. Successfully sanitizing the retired drive does not sanitize the backup. The claim concerns the specified copy, not every occurrence of the information.

Similarly, verifying that an operation completed and deciding that its result adequately protects the target data are distinct judgments. The current NIST guide calls these verification and validation.^[ref]

Sanitization validation decides whether a data sanitization outcome is adequate for its intended data-protection objective. It considers the evidence from sanitization verification, the suitability of the method and any relevant errors or anomalies. The result is an acceptance or rejection of the sanitization claim.^[ref]

For an original distinction, suppose a device reports that its selected operation completed successfully, but the method was not suitable for the stipulated recovery capability against which the data was meant to be protected. The operation can have passed its completion check while the sanitization claim is rejected. This is a mismatch between a successful operation and an inadequate objective, not a contradiction between the two assessments.

An invented batch example makes the denominator explicit. Of20 outcomes,19 have successful completion evidence. Of those19, only15 also satisfy the stipulated adequacy criteria. The accepted fraction is then $15/20=75\%$ of the batch, or $15/19\approx 78.9\%$ of the successfully completed operations. Reporting only $19/20$ would answer the verification question while leaving the validation question unresolved.

The scope remains the specified target data on the specified medium. A decision about one device does not establish that a separate backup or another copy of the same information has also been sanitized. Validation connects the observed evidence to a bounded protection claim.

Sanitization verification checks the outcome of an attempted data sanitization operation: whether the technique completed, and whether its result shows errors or anomalies. In the NIST terminology, this is distinct from sanitization validation, which decides whether the outcome adequately protects the target data.^[ref]

The evidence depends on the technique and medium. It may include a tool's completion status, device-health information or inspection of the remnants of a destructive process. A successful status message concerns the operation that was actually attempted; it does not establish that the chosen technique was appropriate.^[ref]

For an original accounting example,20 devices enter an assessment. Nineteen report successful completion and one reports an error. The completion fraction is $19/20=95\%$. That figure is not a95-percent probability that every device is sanitized, nor does it show that each of the19 successful outcomes meets the intended protection objective.

A useful record preserves both the attempted operation and its observed outcome. Without that link, an otherwise plausible completion report could refer to the wrong device or a different attempt. Verification supplies evidence for a decision; it is not a substitute for the decision itself.