A Sanitization Coverage Model: Count Evidence Without Hiding Gaps

Short answer

A coverage fraction can help track sanitization evidence only after the scope and denominator are defensible. Counting successful bytes while omitting unknown storage produces a precise number for the wrong question.

This article proposes an original accounting model, not a sanitization standard, physical law, recovery-probability estimator or proof of irreversible erasure. It partitions a declared scope into accepted, pending and unresolved regions. A numerical fraction is reported only when the region sizes and complete declared scope are known. Every required exception still needs a disposition, regardless of how high the fraction becomes.

Who this is for

This model is for engineers and reviewers designing evidence records for a qualified sanitization workflow. It is useful when one operation produces several partial results or a board contains multiple storage components.

“Accepted” means that a reviewer has accepted the evidence for the stated region under the chosen method and policy. The formula does not make that judgment. It also does not discover missing hardware, physical mappings or surviving copies. Those are inputs that require independent evidence.

When to use this

Use the model to expose unfinished work, keep a stable denominator and prevent repeated observations from being counted twice. Freeze the target-data scope, observation layer, units and region definitions before processing results.

The device examples motivating this discipline are practical: an EEPROM page write can wrap within a page, a protected region can reject data, and a sequential memory access can roll over at the end. A transmitted byte count is therefore not automatically a count of distinct, successfully processed addresses.

When not to use this

Do not present the result as “percent secure,” “probability clean” or a certification threshold. A small region can contain the only surviving decryption key. Byte count does not measure confidentiality impact.

Do not combine logical addresses and their underlying physical cells into one additive denominator. They are different views of related storage and can double-count the same target data. Do not add a guessed size for inaccessible spare storage simply to make the arithmetic run.

Workflow

1. Define the universe and the measure

Let Omega be a finite, explicitly declared universe of target storage locations at one observation layer. For a byte-based example, each location is one byte address in that declared scope. Let mu(S) count the number of bytes in a set S.

Partition Omega into disjoint regions R_i whose sizes w_i = mu(R_i) are positive byte counts. “Disjoint” means no address is included in two regions; “complete” means their union is the entire declared universe. A region's identity must also identify the component or address domain, since address zero on two chips is not the same location.

These are accounting assumptions, not observations established by the equation. Confirm them from the qualified storage map. A board inventory that might omit another component does not establish a closed scope merely because its listed rows have sizes.

2. Assign one evidence state per region

Use three exclusive states:

• Accepted: the stated region's evidence has passed the applicable review.
• Pending: the region is known, but required work or review is incomplete.
• Unresolved: coverage, access, outcome or supporting evidence remains uncertain.

Let the corresponding sets be A, P and U. With a complete partition:

Omega = A union P union U
A intersect P = A intersect U = P intersect U = empty
mu(Omega) = mu(A) + mu(P) + mu(U)

A read error does not become accepted simply because it was logged. A command's successful submission does not by itself establish the accepted state. Keep the operation result and reviewer basis attached to the region.

3. Derive the accounting fraction

For known, positive total size, define the proposed evidence-coverage fraction:

C_evidence = mu(A) / mu(Omega)
           = sum(w_i for accepted regions) / sum(w_i for all regions)

The second expression follows from additivity of byte counts over disjoint regions. Both numerator and denominator are in bytes, so the ratio is dimensionless and lies between zero and one. Multiply by 100 to express it as a percentage.

The ratio says how much of the declared byte scope has accepted evidence. It does not say which locations contain sensitive data, how difficult recovery would be, or whether the chosen method is appropriate. An accepted logical region also does not establish acceptance of inaccessible physical locations outside that universe.

4. Work through a numerical example

Suppose a fictional, fully mapped scope contains three disjoint regions at the same layer:

Region	Size	Evidence state
A	80 MiB	Accepted
B	15 MiB	Pending
C	5 MiB	Unresolved

Here, 1 MiB = 1,048,576 bytes. Total size is 100 MiB = 104,857,600 bytes, and accepted size is 80 MiB = 83,886,080 bytes.

C_evidence = 83,886,080 / 104,857,600 = 0.80 = 80%

After B receives accepted evidence, the fraction becomes 95%, but C remains unresolved. This model provides no rule that permits release at 95%. If all required regions are later accepted and the inventory is closed, the ledger can be marked complete for that declared scope; the broader release decision still requires the qualified method and policy.

These numbers describe an illustrative ledger, not measured hardware or a recommended acceptance threshold.

5. Refuse an unknown denominator

Now suppose the 80 MiB accepted range is known, but additional required storage has an unknown extent. The total size of Omega has not been established. Do not report 100% by dividing the known accepted bytes by themselves.

Report the known accepted size and the unresolved extent separately. In this model, C_evidence is undefined, not zero and not an estimated percentage. Even if every visible address passes read-back, the record must retain the missing-scope question.

A similar problem occurs when someone silently removes failed regions from the denominator. The fraction may rise although no additional data was processed. Version the scope, record the reason for any change, and obtain a new review instead of rewriting the original accounting history.

6. Reproduce the arithmetic without accessing a device

This Python example treats disjoint, same-layer regions as an input assumption. It checks record identity, states and sizes; it does not inspect address maps or prove that region definitions are disjoint.

from fractions import Fraction


def coverage_ledger(rows, scope_closed):
    valid_states = {"accepted", "pending", "unresolved"}
    if not isinstance(scope_closed, bool):
        raise ValueError("scope_closed must be a boolean")
    if not rows:
        raise ValueError("declare a nonempty scope")
    seen = set()
    totals = {state: 0 for state in valid_states}
    sizes_known = True
    for name, size, state in rows:
        if name in seen or state not in valid_states:
            raise ValueError("duplicate region or invalid state")
        seen.add(name)
        if size is None:
            sizes_known = False
        elif isinstance(size, bool) or not isinstance(size, int) or size <= 0:
            raise ValueError("size must be positive bytes or None")
        else:
            totals[state] += size
    fraction = None
    if scope_closed and sizes_known:
        fraction = Fraction(totals["accepted"], sum(totals.values()))
    complete = (scope_closed and sizes_known
                and all(state == "accepted" for _, _, state in rows))
    return {"known_bytes_by_state": totals,
            "fraction": fraction, "ledger_complete": complete}


MiB = 1024 * 1024
rows = [("A", 80 * MiB, "accepted"),
        ("B", 15 * MiB, "pending"),
        ("C", 5 * MiB, "unresolved")]
result = coverage_ledger(rows, scope_closed=True)
print(result["fraction"], result["ledger_complete"])
unknown = [("visible", 80 * MiB, "accepted"),
           ("unmapped extent", None, "unresolved")]
print(coverage_ledger(unknown, scope_closed=False)["fraction"])

The expected first line is 4/5 False; the final line is None. Exact rational arithmetic avoids rounding in the accounting ratio. It cannot repair a bad scope definition, mislabeled evidence or a missing device.

7. Challenge the result before acceptance

Three counterexamples show the model's limits.

First, two observations of the same 80 MiB range are still 80 MiB of distinct coverage. Adding their byte counts would double-count the numerator. Use address-domain identities and interval review before creating disjoint rows.

Second, 99.9% of a byte scope can have accepted evidence while a tiny remaining key store preserves access to important data. No proportionality between byte fraction and confidentiality risk has been assumed or established.

Third, a complete logical ledger may coexist with unassessed physical storage. Changing the word “logical” to “physical” in the report does not create the missing mapping evidence. Maintain separate views and their supported relationship.

Verification checklist

• The universe, observation layer, unit and scope version are explicit.
• Regions are complete and disjoint within declared address domains.
• State assignments have actual evidence and reviewer bases.
• Unknown extents prevent a numerical coverage claim.
• Duplicate observations and denominator changes are visible.
• Ledger completeness is not substituted for method adequacy or release approval.

Resale and evidence checklist

Retain scope versions, region definitions, underlying operation evidence, state changes, exceptions and reviewer decisions. Show accepted byte count alongside pending and unresolved scope rather than publishing a percentage alone.

NIST SP 800-88 Rev. 2's verification and validation distinction is compatible with keeping operation outcomes and acceptance decisions separate. The formula, state names and completeness test here are proposed editorial tools; they are not NIST-prescribed calculations or certificate fields.

What not to publish

Do not expose customer data, private mappings, key material or identifying records. Do not label the fraction as an industry standard, a law of erasure or an experimentally measured recovery probability. It establishes no software certification or forthcoming product capability.

Common mistakes

Counting only accessible bytes in an unstated universe. Name that logical scope and keep broader gaps explicit.

Removing failures from the denominator. A changed inventory is not additional sanitization work.

Mixing physical and logical capacities. Use one layer and avoid double-counting related views.

Treating accepted bytes as a risk score. Confidentiality impact depends on what remains and the method, not volume alone.

CliDeck workflow fit

A runbook can require scope identity and region-level evidence before a reviewer sees a summary percentage. This is a proposed workflow design, not a claim that CliDeck currently implements the model or certifies sanitization results.

FAQ

Is this a new sanitization standard?

No. It is a proposed accounting model with explicit assumptions and limited purpose. The applicable method and policy remain separate inputs.

Can I calculate coverage when hidden storage size is unknown?

Not for a universe that includes that unknown extent. Report known sizes and the unresolved scope without inventing a denominator.

Does a complete ledger prove data is unrecoverable?

No. It records accepted evidence within its declared scope. The evidence quality, technique, mapping and confidentiality decision must be justified separately.

Related guides

Compare zero-failure confidence bounds, examine NAND bad-block evidence, and apply the inventory approach to EEPROM, FRAM and MRAM.

Verification note: arithmetic checked, no sanitization trial

The example code, exact fraction, state transitions and unknown-denominator behavior were checked with Python. No storage was accessed or sanitized. The model is a proposed recordkeeping aid, not an empirical erasure result.