The Gold Standard · Experimental Design
Make the decision path visible
A successful recovery does not end the problem if nobody can prove where the extracted artefacts came from. A calibration file may be copied without its directory context, a package lockfile may have been regenerated, or a result may match only because an unrecorded dependency remained available. When media disposition is proposed, one group may argue for deletion while another fears losing the last reconstructable evidence.
The gold standard makes recovery provenance explicit and gives disposition a fair appeal route. It distinguishes material scientific evidence from broad retained capability, reconstructs outputs on the approved destination and chooses sanitisation, archival retention or a bounded renewed exception from a reviewable record.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · DEFINE RECOVERY PROVENANCE
1. Define a recovery evidence packet
Record source medium, path, hash, extraction identity, time, tool, transformation, destination and the output or claim the artefact supports.
A useful file without lineage is a clue, not yet reliable reconstruction evidence.
CHAPTER 2 OF 12 · DEFINE RECOVERY PROVENANCE
2. Separate scientific need from retained capability
Identify the minimum data, code, environment and metadata needed to understand material results, apart from broad images, credentials or network state.
Preservation should keep meaning while removing unnecessary live authority.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · DEFINE RECOVERY PROVENANCE
3. Design a disposition appeal
Give scientific, security, legal and records owners a time-bounded route to present evidence, challenge assumptions and propose narrower retention.
Appeal should improve the decision record without becoming indefinite default retention.
| Field | Evidence |
|---|---|
| Source | Medium and path |
| Identity | Hash and extractor |
| Method | Tool and transform |
| Use | Output or claim |
CHAPTER 4 OF 12 · DETECT DRIFT
4. Recognise recovery drift
Look for missing hashes, renamed files, undocumented conversion, mixed extraction sessions, regenerated dependencies and destination results that cannot be repeated.
A matching output can still be weak evidence when the reconstruction path is unknown.
CHAPTER 5 OF 12 · DETECT DRIFT
5. Test provenance by independent reconstruction
Use the packet to rebuild a material output in a clean approved environment. Compare inputs, logs and results with the recovery record.
Independent repetition tests whether the artefact is truly sufficient and whether hidden dependencies remain.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · DETECT DRIFT
6. Worked example: a calibration export loses its source context
A retained image yields a calibration table that restores a published figure. The table has no original path or extraction log, and its values could belong to either of two instrument runs. Security proposes sanitising the image; the study team appeals because no other copy exists.
Governance freezes disposition, performs a read-only directory review and recovers the audit context that identifies the correct run. Changed-context check: the appeal should fail when the disputed file is unrelated to material claims and an independently certified copy already preserves the same meaning and metadata.
| Component | Question |
|---|---|
| Data | Which rows matter? |
| Code | Which version runs? |
| Environment | Which dependency is essential? |
| Metadata | What preserves meaning? |
CHAPTER 7 OF 12 · REPAIR AND DECIDE
7. Contain provenance uncertainty
Quarantine extracted artefacts and affected outputs, suspend routine media access and preserve the original medium, logs and decision record.
Containment prevents uncertain files from silently becoming the new authoritative baseline.
CHAPTER 8 OF 12 · REPAIR AND DECIDE
8. Repair lineage with the smallest extraction
Recover only needed context, verify hashes, record tools and transformations and update the frozen manifest. Rebuild the output on the destination.
The repair should reduce dependence on retained media rather than expanding it.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · REPAIR AND DECIDE
9. Evaluate the disposition options
Compare sanitisation, archival retention and a renewed exception against retention duties, confidentiality, scientific materiality, reconstructability and residual capability.
The best option preserves justified evidence with the least unnecessary authority.
| Option | Primary condition |
|---|---|
| Sanitise | No justified need |
| Archive | Evidence needed, no live use |
| Renew exception | Temporary gap remains |
| Re-extract | Lineage repair needed |
CHAPTER 10 OF 12 · CLOSE WITH DURABLE EVIDENCE
10. Issue an appealable decision
State evidence considered, findings, excluded capability, disposition action, deadline, reviewer and conditions for reopening.
A clear decision lets later reviewers understand why evidence was kept or destroyed.
CHAPTER 11 OF 12 · CLOSE WITH DURABLE EVIDENCE
11. State limits and common misconceptions
Hashes prove identity, not meaning; certified copies can preserve errors; and old environments may depend on hardware or licences that cannot be retained. Sanitisation does not prove scientific validity.
Record residual dependencies and unresolved claims separately from security closure.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · CLOSE WITH DURABLE EVIDENCE
12. Monitor the final evidence state
Retest material reconstruction after platform, format or retention changes. Review appeals, exceptions, media actions and unresolved provenance gaps before deadlines.
The gold standard closes broad capability while keeping the study intelligible for its justified life.
| Record | Requirement |
|---|---|
| Evidence | Named and reviewable |
| Finding | Claim-specific |
| Action | Owner and deadline |
| Reopen | Trigger defined |
Frequently asked questions
What is an extracted-artefact provenance gap?
It is missing evidence about where a recovered file came from, how it was transformed and which result it can legitimately support.
Why allow a media-disposition appeal?
Because security, records and scientific needs can conflict, and a bounded appeal can reveal a narrower way to preserve necessary meaning.
Does a matching reconstructed result prove provenance?
No. It supports consistency but does not identify hidden dependencies, source context or transformations.
When should retained media finally be sanitised?
When justified retention and reconstruction needs are satisfied, the decision is reviewed and the remaining evidence is preserved in a safer governed form.
Continue through verified routes
Core routes
Experimental Design subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Source-platform decommissioning evidence drift, retained-media exception expiry and reconstruction failure recovery
- Final-isolation surveillance drift, emergency access and decommissioning assurance
- Historical-environment final isolation, migration survival and dormant credentials
- Historical-environment drift, export-control breaches and re-containment