10

Say there is a SQL database that stores certain records in encrypted. A person wants deletion of a record in a way that even hard drive recovery services cannot recover it without breaking the hard drive.

Is it possible to delete records this way?

1
  • So the records are encrypted. Where is the key? Is it a file, or stored in the database? – forest Feb 21 at 6:50
14

The more layers you add above the actual data, the harder it will be to securely erase it, because it could have been stored in caches, journals, etc.

Most SQL databases first store information for data modification in a rollback segment to be able to rollback the transaction. Unless a specific database has an option to securely wipe the rollback segment, you should take care of it yourself, and depending on the database, it could be hard if it is even possible.

Furthermore, for security reasons, many professional-grade databases offer a journaling feature. This is a nice recovery feature in case of a crash: you re-install a backup, and replay the journal files registered from the backup date. It guarantees that all records added since that backup are stored in the journal files.

And this does not account for possible caching operations...

Said differently, if you want to securely erase some record, you are better off storing the record directly in a file and preferably not on a SSD drive*. That way, you could rewrite the records many times with a well-known erasure pattern making the original record un-recoverable.


(*) ssd drives can write a new version of a block in a different place. Most offer a secure erasure of the full disk, unsure for the secure erasure of a disk sector.

7
  • On top of the issues Serge mentioned, deleting a database record only de-allocates the database pointers, the data still exists and the space is not deallocated from the file system for optional wiping until the database runs a specific program, often called Vacuum or Compress, to essentially defragment the database file space. Then there's backups, both explicit and system implicit. – user10216038 Feb 20 at 18:22
  • So how the big companies delete when we have the right to delete personal information like Facebook or Google is ordered to delete? – kelalaka Feb 20 at 21:59
  • 4
    @kelalaka I didn't find any definition in the GDPR (for example) of what "erase" means, but I don't think it would be interpreted in the strict sense in use here. A standard database deletion, possibly extending to backups/snapshots, would probably suffice. I doubt any data controller will get dinged for having a user's data still resident in some unused SSD space. – Chris Hayes Feb 20 at 23:55
  • 2
    @kelalaka It would depend on what (if anything) applicable laws say about the matter. They might say nothing beyond "must be deleted" or they may go into detail about secure-erasure processes. – TripeHound Feb 21 at 0:01
  • 3
    @kelalaka The right to delete personal information doesn't mean they have to delete it so it cannot be recovered by forensic means! They aren't even required to delete it from their backups. – Ángel Feb 21 at 2:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.