What is secure deletion?¶
The practical answer¶
Secure deletion is an attempt to remove data in a way intended to make normal recovery more difficult.
The key evidential caution¶
The dangerous assumption is that using a deletion tool proves the targeted data was destroyed completely.
It may not.
Effectiveness depends on:
Key points¶
- storage type
- file system
- encryption
- snapshots
- backups
- cloud replication
- wear levelling
- provider retention
- whether the tool completed
Secure-deletion activity may involve:
- overwriting files
- wiping free space
- deleting snapshots
- destroying encryption keys
- removing cloud objects
- reformatting storage
- using specialist wiping tools
Evidence to preserve¶
Investigators should preserve:
Key points¶
- the command or tool
- target path or device
- account and process
- start and completion time
- errors
- system and storage context
- copies or replicas elsewhere
- provider and backup records
Deletion may remove the visible file while metadata, logs, backups or remote copies remain.
Evidential limits¶
Likewise, a tool being present does not prove it was used successfully.
Do not repeatedly test recovery on the original media.
Specialist examination may be required.
Cloud and modern solid-state storage may retain, replicate or discard data differently from traditional disks. Provider snapshots, version history and encryption-key records may be more important than repeated local recovery attempts. Current platform behaviour should be verified before conclusions are drawn.
Where encryption keys are destroyed, the underlying encrypted data may remain physically present but unusable. Preserve key-management logs, access records and deletion events. Loss of the key and erasure of the data are technically different effects and should be reported separately.
Operational takeaway¶
Prove what deletion method targeted which data, whether it completed and what copies or metadata survive before concluding that evidence was destroyed.