🗑️ Define electronic-media sanitization and disposal logging

[JFWooten4]

The data-destruction policy currently says that deleted contents and unused drive space should be overwritten with a rewriting utility such as cipher:¹

org-docs/docs/incidents/disposal.md

Line 9 in 94f6a58

Devices used to manage sensitive information employ encrypted disks to harden working copies against local theft. Wiped drives are still considered protected until their trashed contents and unused space are wiped over by a rewriting scratch utility such as `cipher`. While we do not maintain consumer reports or credit assessments for our business purposes, any legal scans of lost investor information must only be accessed and processed by fingerprinted team members.

This needs to distinguish between storage technologies and between deleting particular files, sanitizing a retained device, and sanitizing an entire device before disposal.

“Overwrite the drive with zeros” or “zero-fill the drive” is appropriate terminology for an overwrite operation. However, ordinary software overwrites cannot reliably sanitize SSDs because wear leveling and remapped storage may leave data outside the software-accessible address space.

Brainstorming

The procedure should identify an appropriate method for each storage type:

• Magnetic HDD: overwrite the entire drive with zeros. Free-space overwriting may be used when retaining the filesystem, where supported.
• SATA SSD: use ATA Sanitize or a supported ATA Secure Erase function.
• NVMe SSD: use NVMe Sanitize.²
• Apple silicon or T2 Mac internal storage: use Apple’s supported cryptographic erase process, such as Erase All Content and Settings or erasing the encrypted volume, rather than attempting a software overwrite.
• Flash media without a supported sanitize function: use cryptographic erasure when the media was encrypted from initial use or physically destroy the media.

Very Loose Ideas

The procedure should also require confirming the device identifier and storage protocol, verifying that the selected command is supported, and running destructive operations from another boot device when necessary.

Each sanitization or destruction should be recorded in a disposal log containing:

• Date and time
• Device or asset identifier
• Manufacturer, model, and serial number
• Storage type and protocol
• Sanitization method and tool used
• Operator
• Completion and verification result
• Final disposition, such as reuse, recycling, or physical destruction
• Related action-list or disposal record
• Any third-party custodian and chain-of-custody details

Possible Tasks

• Replace the generic cipher and unused-space rewriting language.
• Distinguish file deletion, free-space overwriting, whole-device sanitization, cryptographic erasure, and physical destruction.
• Document supported methods for HDD, SATA SSD, NVMe SSD, and Apple-integrated storage.
• Add a standard disposal-log template.
• Define where disposal records are retained and who reviews them.
• Require verification of sanitization completion before a device leaves organizational control.

Note

The reporting of actions could use something like incident-response issue tagging. Members could provide their documentation and evidence summaries in a timestamped and tagged issue.

Footnotes

1. cipher is Windows-specific and should not be presented as a general sanitization method. ↩

2. ATA and NVMe sanitize operations affect the entire device and cannot selectively purge previously deleted files. ↩