Residual Information Protection

1. Feature Description

Residual information protection prevents sensitive data from remaining in resources after they are released. When database files or memory objects are no longer needed and enter the resource cleanup process, TimechoDB processes the resources within the protection scope to reduce the risk of recovering and exploiting residual data after resources are reallocated. This feature applies only to the files and memory objects explicitly included in its scope; it does not erase all database files or all process memory.

When residual information protection is enabled, TimechoDB performs the following operations during supported resource cleanup processes:

• Files: Overwrite the contents of protected files before deleting or truncating them.
• Memory: Clear the data in protected memory objects before releasing them, returning them to a memory pool, or replacing them with new objects.

Note: This feature is available from V2.0.12.1.

2. Protection Scope

Residual information protection applies only to the files and memory objects listed in this section. It does not erase every file in the database directories or all memory used by the process.

2.1 Files

Node	Main protected files
ConfigNode	ConfigRegion consensus logs and state machine snapshots; user and role profile files; temporary files on the Pipe receiver; installed Pipe plugin files.
DataNode	TsFile, resource, and mods files in sequential and unsequential spaces; Object files; data snapshot files; Pipe TsFile hard links and temporary files on the receiver; staging files for LOAD tasks; WAL and checkpoint files; DataRegion and SchemaRegion consensus logs and snapshots; local SchemaRegion metadata files; temporary files generated by queries, sorting, repair, UDFs, Triggers, and Pipe plugins.

These files are erased when they enter a supported deletion or truncation process.

2.2 Memory

The main protected memory objects include:

• WAL working, idle, and synchronization buffers: Cleared before being returned for reuse after a disk write completes, or before shutdown or buffer resizing.
• Reusable WAL compression buffers: Cleared after compressed content is written to disk, and before shutdown or resizing.
• Pooled primitive arrays used by MemTables: Cleared when a TVList or AlignedTVList reaches the end of its lifecycle, before the arrays are returned to the memory pool or discarded. Point deletion only marks data; arrays are not erased prematurely while queries or flush tasks may still reference them.
• User passwords: Password information retained in memory is cleared after a user is deleted.

3. Enabling the Feature

Use the enable_secure_erase parameter to enable or disable residual information protection:

Parameter	Type	Default	Effective after	Description
enable_secure_erase	Boolean	false	Service restart	Whether to enable residual information protection. true enables it; false disables it.

Configure the following in iotdb-system.properties:

enable_secure_erase=true

Only users with the SYSTEM privilege can modify this parameter.

4. Notes

• This feature is not supported on Windows.
• *.lock files are outside the current protection scope.