Systems and methods for securing storage space

A system for secure storage space, the system comprising:

• an interception module programmed to:
• identify a deallocation operation directed to a block, within a storage system, whose contents comprise non-zeroed data, wherein the block was previously allocated for use in an old thin-provisioned logical disk;
• identify a read operation directed to the block;
• a marking module programmed to:
• in response to identification of the deallocation operation, mark a block map to indicate that the block is to return, in response to read operations, zeroed data instead of the contents of the block;
• mark an additional block map to indicate that the block is subject to a pending trim operation by the storage system and to represent the block as a free but previously allocated block in response to identifying the deallocation operation directed to the block, wherein the additional block map was copied from the block map and is updated in parallel with the block map;
• wherein marking the block map to indicate that the block is to return zeroed data comprises marking the block map to indicate that the block is to return zeroed data before the trim operation is performed;
• a determination module programmed to determine, in response to identification of the read operation, that the block map indicates that the block is currently allocated for use in a new thin-provisioned logical disk while still comprising data from the old thin-provisioned logical disk and is to return, in response to read operations, zeroed data instead of the contents of the block;
• a returning module programmed to return, in response to the read operation, zeroed data instead of the contents of the block in response to determining that the block map indicates that the block is to return zeroed data instead of the contents of the block in order to protect potentially sensitive data previously stored on the old thin-provisioned logical disk;
• at least one processor configured to execute the interception module, the determination module, and the returning module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify a deallocation operation directed to a block, within a storage system, whose contents comprise non-zero data, wherein the block was previously allocated for use in an old thin-provisioned logical disk;
• in response to identifying the deallocation operation, mark a block map to indicate that the block is to return, in response to read operations, zeroed data instead of the contents of the block;
• mark an additional block map to indicate that the block is subject to a pending trim operation by the storage system and to represent the block as a free but previously allocated block in response to identifying the deallocation operation directed to the block, wherein the additional block map was copied from the block map and is updated in parallel with the block map;
• wherein marking the block map to indicate that the block is to return zeroed data comprises marking the block map to indicate that the block is to return zeroed data before the trim operation is performed;
• identify a read operation directed to the block;
• determine, in response to identifying the read operation, that the block map indicates that the block is currently allocated for use in a new thin-provisioned logical disk while still comprising data from the old thin-provisioned logical disk and is to return, in response to read operations, zeroed data instead of the contents of the block;
• return, in response to the read operation, zeroed data instead of the contents of the block in response to determining that the block map indicates that the block is to return zeroed data instead of the contents of the block in order to protect potentially sensitive data previously stored on the old thin-provisioned logical disk.