Prove data is gone, three ways, with evidence

applied · 80 min · Objective 4.2

Task

Write data to a disk image, then attempt to recover it after a delete, an overwrite and a cryptographic erase. What you can still recover is the argument for each sanitisation method, and the certificate you produce is what an auditor accepts.

Steps

  1. Create a small disk image: dd if=/dev/zero of=/tmp/disk.img bs=1M count=64, format it, mount it, and write twenty files containing a recognisable synthetic marker string.
  2. Method one — delete: rm the files, unmount, and search the raw image for the marker with grep -c. Record how many survive.
  3. Restore the image and try method two — overwrite: use a tool that overwrites file contents before unlinking, then search again.
  4. Restore and try method three — cryptographic erase: create the filesystem inside an encrypted container, write the files, then destroy the key and search the raw image.
  5. Record the three recovery counts in /tmp/sanitisation.md, with a note on which method would be appropriate for an SSD and why overwriting is less reliable there.
  6. Write /tmp/certificate.md: the certificate of destruction an auditor would accept — what was destroyed, by what method, when, by whom, and what evidence supports the claim.

Verify

grep -c "LABMARKER" /tmp/disk-deleted.img || echo 0
grep -c "LABMARKER" /tmp/disk-overwritten.img || echo 0
grep -c "LABMARKER" /tmp/disk-cryptoerased.img || echo 0
python3 - <<'PY'
def hits(p):
    try: return open(p,'rb').read().count(b'LABMARKER')
    except FileNotFoundError: return None
d,o,c=hits('/tmp/disk-deleted.img'),hits('/tmp/disk-overwritten.img'),hits('/tmp/disk-cryptoerased.img')
print('after delete: %s | after overwrite: %s | after crypto-erase: %s' % (d,o,c))
assert d and d>0, 'delete should leave the data recoverable - that is the point of the first round'
assert o==0, 'the overwrite did not remove the content'
assert c==0, 'the crypto-erase left plaintext - the files were written outside the encrypted container'
PY
grep -ciE "method|witness|date|evidence" /tmp/certificate.md

The first assertion is the one that teaches: after a plain delete the marker must STILL be present, because deleting a file removes a directory entry and not the bytes. The other two must be zero. The certificate grep must be at least three — an auditor needs method, date and who, not an assurance.

Notes

Now map this onto hardware. Overwriting works on magnetic media and is unreliable on an SSD, because wear levelling means the controller may never touch the physical cells holding the old data. That is why cryptographic erase — encrypt from day one, destroy the key — is the practical answer for SSDs and for cloud storage you cannot physically reach.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.