Does removal from a leak site prove the data was deleted?¶
The practical answer¶
No. Removal of a victim entry or download link does not prove that stolen data was deleted.
The key evidential caution¶
The dangerous assumption is that disappearance from public view means the offender no longer retains or can distribute the information.
The data may still exist:
Key points¶
- with the original offender
- with affiliates
- on backups
- with purchasers
- on mirrors
- in private channels
- on seized or abandoned infrastructure
- with third parties who downloaded it
Removal may occur because of payment, negotiation, technical failure, law-enforcement action, site maintenance or a tactical decision.
Evidence to preserve¶
Investigators should preserve the earlier listing, publication time, samples and any later removal or change.
Evidential limits¶
Do not state that data was destroyed unless there is reliable evidence supporting that conclusion.
Even a promise of deletion is difficult to verify technically.
The risk assessment should consider the number of parties who may have accessed or copied the material.
Where removal follows payment, preserve the exact sequence and any promise made by the offender. That may evidence the negotiation outcome, but it still cannot verify deletion from private storage, mirrors or copies already obtained by others.
Data may also persist in search caches, archives or third-party reporting even after the original page disappears. Preserve those later appearances carefully and distinguish original offender publication from independent republication by others.
If the organisation receives an assurance of deletion, preserve the exact wording and conditions. Treat it as a representation made by the offender, not as a verified technical fact, unless independent evidence supports it.
Operational takeaway¶
Treat leak-site removal as evidence that public availability changed, not proof that every copy was deleted or that disclosure risk ended.