The Gold Standard · Experimental Design
Make the decision path visible
An appeal protects valuable evidence only when it can reach a decision. Drift begins when every failed reconstruction produces a broader retention request, when the same objection returns without new evidence or when nobody has authority to decide that the scientific minimum has been preserved and the remaining medium should be sanitized.
The gold standard turns the appeal into a bounded evidence test. It names the material claim, reconstructs it from a clean destination, preserves the minimum data and provenance needed for review, and gives a competent authority power to order and verify final sanitisation.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · FRAME FINAL AUTHORITY
1. Define the reconstruction evidence challenge
Name the result or claim, the retained medium, the alleged missing dependency, the failed reconstruction step and the decision that would change if the challenge succeeds.
A general fear that something may be lost is not yet a testable scientific objection.
CHAPTER 2 OF 12 · FRAME FINAL AUTHORITY
2. Specify the scientific preservation minimum
List the data, code, environment description, calibration, audit context and provenance needed to understand material outputs. Separate these from credentials, broad system images and unrelated records.
The preservation minimum should keep meaning without preserving avoidable operating authority.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · FRAME FINAL AUTHORITY
3. Assign appeal and sanitisation roles
Separate the appellant, scientific reviewer, records owner, security reviewer, sanitisation executor and final decision authority. Define conflicts, deadlines and reopening triggers.
No single team should both argue for retention and certify that every alternative has been tested.
| Field | Record |
|---|---|
| Claim | Output affected |
| Gap | Dependency alleged |
| Test | Reconstruction step |
| Consequence | Decision changed |
CHAPTER 4 OF 12 · TEST RECONSTRUCTION
4. Recognize appeal drift
Look for repeated extensions, changing reasons, missing claim specificity, broader media requests, untested alternatives and exceptions that outlive the study decision.
Delay may be justified, but every extension should preserve a named unresolved question rather than default capability.
CHAPTER 5 OF 12 · TEST RECONSTRUCTION
5. Challenge the reconstruction independently
Use a clean approved environment and frozen manifest. Rebuild a material output, compare inputs and logs, and document every dependency that was not already in the preservation packet.
Independent reconstruction tests both sufficiency and whether retained media is silently supplying unrecorded state.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · TEST RECONSTRUCTION
6. Worked example: an image is retained for one unexplained checksum
A study output reconstructs from the approved archive except for one calibration checksum. The team argues that the full source image must remain because the checksum could identify an unrecorded preprocessing step. Review finds the value in an instrument audit export and reproduces the result without mounting the image.
The archive adds the audit export, manifest and explanation, then authorizes sanitisation. Changed-context check: the full image may remain under a bounded exception when a regulator or records rule requires the original electronic record and the organization can isolate it without routine use.
| Component | Keep |
|---|---|
| Data | Material subset |
| Code | Versioned source |
| Environment | Dependency record |
| Provenance | Audit context |
CHAPTER 7 OF 12 · PREPARE DISPOSITION
7. Freeze a disposition-ready evidence packet
Capture hashes, source paths, extraction logs, transformations, reviewer findings, retention basis and unresolved limits. Store the packet on an approved destination before media action begins.
The packet must be understandable without relying on the medium scheduled for sanitisation.
CHAPTER 8 OF 12 · PREPARE DISPOSITION
8. Choose a method from information sensitivity and media type
Decide whether the target requires clear, purge or destroy treatment under the organization’s policy and the capabilities of the medium. Do not infer successful sanitisation from deletion or reformatting alone.
The method must address the actual technology and the effort an adversary could apply to recover target data.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · PREPARE DISPOSITION
9. Issue the final authority decision
State the evidence considered, appeal finding, retained minimum, excluded capability, method, executor, deadline, verification evidence and triggers that would pause or reopen the action.
Final authority should be explicit enough that execution does not depend on informal permission.
| Question | Evidence |
|---|---|
| Retention | Rule or purpose |
| Method | Media appropriate |
| Authority | Named decision |
| Reopen | New evidence trigger |
CHAPTER 10 OF 12 · SANITISE AND VERIFY
10. Verify sanitisation and chain of custody
Confirm the correct medium, method completion, exceptions, certificate or record, inventory update and physical or logical disposition. Use a separate reviewer where consequence warrants it.
Verification should demonstrate the process and result required by policy, not merely that a command returned success.
CHAPTER 11 OF 12 · SANITISE AND VERIFY
11. State limits and common misconceptions
Sanitisation protects confidentiality; it does not validate the experiment. Hashes prove identity but not scientific meaning, and a certificate cannot prove that unknown copies never existed.
Record residual copies, legal holds, unobserved dependencies and scientific limits separately from the sanitisation outcome.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · SANITISE AND VERIFY
12. Monitor closure and future reconstruction
Retest material reconstruction after archive migration, format change or major software update. Track renewed exceptions, missing manifests, media inventory discrepancies and appeals supported by genuinely new evidence.
The gold standard closes unnecessary capability while keeping the experiment intelligible and reviewable for its justified life.
| Step | Proof |
|---|---|
| Target | Inventory match |
| Execution | Method record |
| Review | Exception checked |
| Closure | Status updated |
Frequently asked questions
What is retained-media disposition appeal drift?
It is repeated delay or expansion of an appeal without a stable scientific question, evidence requirement or decision deadline.
Does deletion equal sanitisation?
No. Sanitisation uses a method appropriate to the information sensitivity and media technology so access to target data becomes infeasible for the defined effort.
Who should hold final sanitisation authority?
A named competent decision owner who considers scientific, records, legal and security evidence but is not the sole advocate for retention.
Can sanitisation be reopened later?
The completed physical action cannot be undone, but the decision record should define what genuinely new evidence would reopen scientific or governance review.
Continue through verified routes
Core routes
Experimental Design subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Retained-media disposition appeal and provenance gaps
- Retained-media exception expiry and reconstruction failure recovery
- Emergency-access reopening and decommissioning assurance
- Platform migration survival and dormant credential discovery