Data protection by "data destruction" (DESTROY option)

Both in the case of disks and tapes, the user can specify that files that are no longer required can be overwritten with binary zeros and thus “destroyed”. These files are no longer readable in BS2000, even with diagnostic programs and special privileges.

Irrespective of whether this option is used, the following always applies: If a volume (electronic, magnetic or optical storage medium, like hard disk, storage component of a disk storage system, tape etc.) on which sensitive data are or were stored, is exchanged, the volume itself must be destroyed after the data have been deleted in BS2000. This is the only way to guarantee that no data can be reconstructed from this volume.

Using the CATAL macro or the CREATE-FILE and MODIFY-FILE-ATTRIBUTES commands it is possible to specify in the catalog entry that:

• For disk files:
  Storage space assigned to the file is explicitly deleted when it is released.

• For tape files:
  On tape change or following the closing of the output file, any residual data on the tape is deleted.

Disk files

In the case of disk files, it is possible to specify “data destruction” when storage space is released.

This option can either be entered in the file catalog or explicitly specified when files are deleted.

in catalog entry:	CATAL ...,DESTROY=*YES /CREATE-FILE ...,DESTROY-BY-DELETE=*YES /MODIFY-FILE-ATTRIBUTES ...,DESTROY-BY-DELETE=*YES
on deletion:	ERASE ...,DESTROY /DELETE-FILE ...,OPTION=*DESTROY-ALL

Tape files

In the case of tape files, the FILE macro (operand DESTOC=YES) or ADD-FILE-LINK command (operand DESTROY-OLD-CONTENTS=*YES) can be used to specify that any subsequent (old) data on the tape should be overwritten (i.e. physically deleted) when the output file is closed (CLOSE) or the tape is changed.

Automatic “data destruction” on reconstruction

DMS performs automatic “data destruction” when recovering files that were destroyed, for example, due to a system crash: if the file that is to be recovered is located on a private disk or is not cataloged under the job's user ID then the auxiliary files created by DMS in order to perform the recovery are deleted using the “data destruction” mechanism (see "Recovery of files under foreign user IDs").