<a id="ch-09"></a>

## Chapter 9 — Deleting the zip is not a second print

<!-- open-cyber-academy:lesson-figures:start ch-09 -->
### Lesson map

Lesson 09. Map, example, EX055.

```mermaid
flowchart TD
  Z["old-backup.zip in the export"] --> P["Third failure line"]
  R["Retention check with Mark"] --> X["Prose: the zip was deleted"]
  P --> Q{"Does deletion edit the triple?"}
  X --> Q
  Q -->|No| K["The line stays"]
```

Removal from storage is not removal from the evidence list.

### Logical drawing

```text
still printed:  old-backup.zip: anyone-with-link
prose only:     deleted after the retention check
not recorded:   a sanitization method, a recycler, a date
```
<!-- open-cyber-academy:lesson-figures:end ch-09 -->

### Learning outcomes

After this chapter, you should be able to:

1. Keep `old-backup.zip` on the failure list.
2. Place the deletion in the decision log.
3. Refuse a sanitization certificate the file does not contain.

### 9.1 The zip is still the third failure line.

`old-backup.zip` is sensitive and set to `anyone-with-link`, so the comprehension prints it. The prose then says the zip came from a previous system, was no longer needed, and was deleted after Mark and the retention rules were checked. That sequence is a log entry. The triple is unchanged, so a reader of the script still sees the third line.

Deletion here means the clinic stopped keeping that copy. The page does not name a sanitization method, a tool, a recycler, or a disposal date. A certificate of wiping cannot be copied out of a sentence that never stated one. Fewer copies was the stated reason for removing an unneeded archive, not a measured proof that every other copy was found.

The activity-log check before the deletion is also prose. It is not a column beside the triple. Invoices were restricted rather than deleted; that different action must not be collapsed into the zip's story. Both objects remain failure lines in the export.

### 9.2 Worked example

| Claim | Where it would have to be | Decision |
|---|---|---|
| The third line names `old-backup.zip` | The filter output | Keep |
| The zip was deleted after a retention check | The log | Keep as prose |
| "The script dropped the zip once it was deleted." | No edited list | Refuse |
| "A wipe certificate shows the method." | No method is written | Refuse |

> **Synthetic case.** Mark is the owner who was consulted. No disposal firm is named.

### Errors and limits

Do not describe a wiping procedure. The evidence stops at the export line and the log.

### Apply

- **EX055 — Zip versus log.** A classmate removes `old-backup.zip` from the eight triples, prints `shared too widely 2`, and attaches a wipe certificate. What remains true? *Rubric:* 3 = the triple stays; the third failure line stays; deletion stays in the log after the retention check; no method, recycler, or date is printed;; 2 = the line stays and the certificate is refused;; 1 = one point;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-09 -->
### Continue studying — lesson 09 (chapter 09 of 20)

[← Chapter 08](#ch-08) · [Course chapter index](../SUBJECTS.md) · [Chapter 10 →](#ch-10)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex055"></a>
**EX055.** `old-backup.zip` stays the third failure line. Deletion after the retention check with Mark stays in the log. No sanitization method, recycler, or disposal date is printed.
