The certificate is the thing you are actually buying. The erase is a few hours of a machine's time; the document is what remains, and it is the only part of the transaction that an auditor, a regulator or a customer will ever look at. Most of the certificates in circulation are not evidence — they are receipts.
The unit has to be the asset
A batch certificate tells you that a pallet of drives was processed. The question anyone actually asks is about a particular drive — the one that turned up in a cupboard, the one on the asset register that nobody can account for. If the document cannot be searched by serial number it cannot answer that, and its usefulness ends at the filing cabinet.
What each record needs
- Make, model and serial number of the device, so it ties to your asset register.
- The standard applied, by name and revision — not "military grade", which means nothing.
- The verification method and its result. A certificate that only records the write is recording an intention.
- Start and end time, and how long the operation took. An implausibly short run is the first thing a careful auditor checks.
- Who performed it, identified as a person or an account rather than as "the system".
- A hash of the document's own contents, so a copy can be checked against the original.
It has to record failure
This is the part that separates a document worth trusting from a document worth nothing. If a certificate is only ever issued on success, then its presence carries no information — every asset has one, including the ones where the drive refused the command. A failed verification has to appear on the record, and the asset has to be routed to destruction, or the whole exercise is theatre.
A certificate that can only say "passed" is not evidence. It is stationery.
The sample certificates this software produces are published in full on the reports page — the real files, not a marketing render, and with no form in front of them. It is the one document a buyer should insist on seeing before purchasing anything, from us or from anyone else.
