Harbor Data / 07 / PRACTICE GUIDE
Secure deletion, media sanitization and disposal evidence
Separate a delete command from verified sanitization. Review media, method, custody and the scope of disposal certificates.
Download guide and workpapersOriginal AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.
EVIDENCE REVIEW DESK
Move from observations to decisions.
Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.
Deletion requested / Incomplete decision
Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.
s => s.deleteRequested === trueA request establishes neither a suitable media method nor authority. Match asset, sensitivity, method and authorized decision before claiming validated disposal.
Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.
01 / EXPLANATION
Deletion, sanitization and destruction
Removing a file from a trash folder does not establish that access to media data is infeasible at the intended level. Choose sanitization through sensitivity, media technology, reuse plans and appropriate validation. NIST SP 800-88 Rev.2 became final in September 2025 and superseded Rev.1. This lesson does not present the older revision as current or provide executable erasure commands for real equipment. Learners assess evidence of suitability for the medium and purpose rather than treating a method name as proof of successful sanitization.
02 / EXPLANATION
Media and key dependencies
HDDs, SSDs, removable media and cloud storage do not share identical physical behavior. Do not assume overwriting a file always suffices on an SSD. Cryptographic erasure also requires review of encryption coverage, key copies and suitable method/evidence. Physical destruction fails its purpose if the wrong device is processed. Harbor matches asset identity, media type, authority, method and validation references. It performs no actual key deletion, formatting or device destruction. Method suitability and verified completion remain separate questions for authorized owners.
03 / EXPLANATION
Validate the disposal certificate
A vendor certificate should cover the actual surrendered assets and intended scope. Record asset/serial identity, custody, date, method, operator and verification role. Receiving a certificate alone does not prove successful execution. State limits of sampling or validation. Harbor’s certificate example is an educational workpaper and issues no official sanitization certificate. Missing assets, mismatched identities and out-of-scope copies remain open work. An invoice or broad vendor assurance should not replace evidence linking the required method to the specific media and outcome.
04 / EXPLANATION
Copy scope at service exit
Service exit separates responsibility for primary records, backups, derivatives and exports. Do not automatically initiate disposal before preservation requirements and authorized decisions are resolved. Document which layer the provider evidence covers and what remains unverified. Harbor produces only review-due after its retainUntil threshold, never disposal authority or commands. Closure includes asset/copy mapping, validation outcomes and residual-risk ownership. The control objective is a traceable result within defined scope, not simply collecting a document that may leave copies or identity mismatches unexplained.
Build the evidence yourself.
Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.
Full guide with code, outputs and reasoning ↓Primary references
Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.