Cryptographically erase, and find the copy that defeats it

applied · 70 min · Objective 3.5

Task

Apply objective 3.5: destroy a key and demonstrate the data is unreadable -- then find the copy elsewhere in your lab that was never inside the key boundary, which is where this technique actually fails.

Steps

  1. Encrypt a dataset with a key scoped to it alone, and confirm you can read it.
  2. Before destroying anything, enumerate every copy: backups, snapshots, replicas, exports, caches, analytics extracts, lower-environment copies. Write them to lab/erase-copies.csv as copy,location,encrypted_with,inside_boundary.
  3. Disable the key, confirm the read fails, re-enable, confirm it succeeds -- demonstrating that disable is the reversible emergency control.
  4. Destroy the key (or schedule destruction) and capture the failed read in lab/erase-result.txt.
  5. Now attempt to read one copy that your enumeration marked as OUTSIDE the boundary, and capture the SUCCESS in lab/erase-defeated.txt. Then bring it inside and record what the design should have been.

Verify

awk -F, 'NR>1 {n++} END {print n" copy(ies) enumerated"}' lab/erase-copies.csv
awk -F, 'NR>1 && $4=="no" {n++} END {print n+0" outside the key boundary"}' lab/erase-copies.csv
grep -Eic 'denied|keyunavailable|cannot decrypt|disabled' lab/erase-result.txt
test -s lab/erase-defeated.txt && echo "a copy survived the erase"

Four or more copies enumerated, at least one outside the boundary, a failed read after destruction, and a surviving copy demonstrated. A single plaintext copy defeats cryptographic erase entirely, which is why it must be designed in rather than adopted later.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.