Verify an erasure record
Check whether the erasure record of a report is unchanged, so that you can use the report as evidence of the erasure.
Prerequisite: The XML report, the JSON file and the .oose file of the report are in the same folder. For reports from another PC, import them first.
- Select Reports and open the report.
- Read the Signature line. It shows the status, the signing certificate and its SHA-256 fingerprint, and the timestamp.
- Compare the status with the table below.
- Check the result of the erasure in the same report.
Result: You know whether the record is authentic and whether the erasure was complete. Both are needed: a valid signature does not mean that every target was erased.
| Status | Meaning |
|---|---|
| Erasure record valid | The record is unchanged since it was signed. |
| Erasure record valid, without timestamp | The record is unchanged; no timestamp service has confirmed the time of signing. |
| Erasure record changed | The content no longer matches the signature. Keep the file unchanged for an investigation. |
| Erasure record unsigned | The record has no verifiable signature. The report names the reason. |
| Gap in the chain of erasure records | A previous record was deleted without a deletion note. |
| Unsigned (legacy report) | The report was created by an earlier version without an erasure record. |
Verify on the command line
The command line checks a record without erasing anything and without a license:
.\OOSafeEraseCmd.exe verify "C:\Reports\Report_example.oose"
The exit code shows the result; see Command line. The record chain can only be checked when the previous records are available on this PC.
Next steps
- Reports and erasure records
- Set operator details, signing certificate and timestamps: Settings