Patent ID: 7593532

Claim:
A method for making data stored in a computer data storage system unrecoverable, comprising: providing a data storage computer system for storing a data originating from a plurality of files stored by one or more client computers as the stored data, the stored data being stored in permanent storage devices by the data storage computer system; providing a root key; providing a first retention key; providing a first file key; encrypting a first data file using the first file key; encrypting the first file key using the first retention key to make a first encrypted file key, and storing the first encrypted file key; encrypting the first retention key using the root key to make a first encrypted retention key, and storing the encrypted retention key; encrypting a plurality of additional first data files using a first selected file key for each additional data file; encrypting each first selected file key by the first retention key to form an encrypted first selected file key, and storing each encrypted first selected file key; discarding the first data file by destroying the first encrypted file key; and discarding the plurality of additional first data files by destroying the first encrypted retention key; using a delete function to mark one or more particular encrypted files of a selected group of files as deleted (hereinafter the deleted files), where each file of the selected group of files is encrypted by a respective file encryption key, each respective file encryption key being encrypted by an old retention key; recovering one or more respective file encryption key(s) corresponding to one or more particular encrypted file(s) of the selected group of files not marked as deleted by un-encrypting the corresponding one or more respective file encryption key(s) using the old retention key: re-encrypting the recovered file encryption key(s) using a new retention key; and discarding the deleted files by destroying the old retention key, while retaining all files of the group of files which were not marked as deleted by retaining the re-encrypted file encryption key(s) and the new retention key.