Slashdot Mirror
Data Still Left on Storage Devices for Sale
cluedweasel writes "According to a BBC story many people are still putting up their old PC's and storage devices for sale without taking basic precautions to ensure that confidential data is erased. The suggestion at the end of the story is to get a professional forensics firm to wipe your data or just destroy the item in question. With the low price of storage devices, the latter is probably preferable."
I've found some interesting stuff on hard drives purchased second hand including tax forms from apparently a CPA, medical records, patent applications, and most interestingly, a fair bit of data that I will not talk about on a NeXT cube off eBay that was originally purchased from a government auction. I was surprised as it was the only cube I had seen with it's hard drive intact. (All hard drives were erased or physically destroyed, because I am a nice guy).
The interesting thing is that protocols for the destruction of data have existed for magnetic media since before the hard drive. With the advent of the hard drive and higher density media, other protocols have come into place, but the solution is not a technical one. It is the hardest of all solutions...... Behavioral change.
Visit Jonesblog and say hello.
I once received about 30 10GB hard disks from the US Army that were tossed in a collection bin (and someone called me to say they were there) which were not wiped and had a fair bit of info on them. Not talking National Secrets, but info that could have been used to cause problems, none the less.
By far the worst, however, was a batch of 15 PIII computers I recovered from the INS. Not only had they not been wiped, but all programs and files were fuctional. Talking about Social Security numbers, Green Card information, and on and on. It was terrible.
Of course, I do the right thing and both wipe and low-level format these before donating on to charity - but it still amazes me what info is given away.
Both of these cases were 1 year+ after 9/11 too. People don't change.
DAMN YOU OCTODOG! DAMN YOU TO HELL!
Once place I worked had enough buying clout that driving nails through the drives would not void the warranty. It was actually in the contract.
That's right, just a single-pass overwrite with zeros will do.
Um...no. Not to be argumentative here, but I have personally been able to recover data from a hard drive after being zeroed. This is why the DoD standard is a bit more stringent than simply zeroing.
____
~ |rip/\/\aster /\/\onkey
There was an article about a year ago (can't find it now) saying essentially the same thing about Macs. Most places just have the tools to hack a Windows PC for files. First, the Mac won't run their tools, and then, even if they yank the drive and put it in another housing, its not formatted in a way their software can access.
Now, as said above, if you were a really big fish, they have ways, but its not a typical forensics op.
You're either:
1) Talking about recovery from an old drive, pre-1997, OR;
2) You're full of shit. Yes, a liar.
So explain yourself, please, because I will apologize immediately if the case is (1) or you can prove me wrong. Cite me some evidence--press releases from the company you worked for, or a paper written by the research team you worked with. Anything, hell--even your blog is something.
I've spent my last four years working as an examiner at a computer forensics firm. I have exhaustively researched this topic several times, hoping against hope that something is out there. There is nothing.
I have encountered a number of documented cases where a party to ligitation claimed that incriminating or exculpatory evidence had been overwritten on a hard drive. In at least two of those cases, the defendants spent more than $500K funding people who said "Oh yeah, I can do that--I just need cash for a lab and a magnetic-force microscope." Nobody EVER recovered over-written data, in any of these cases.
So prove me wrong.
I also bought a second hand computer, from an auction from a company that had gone into receivership, I got it home, turned it on, it wouldn't boot... I fiddled with the internals a bit and low and behold it booted and came up into Windows XP... well, I don't know the passwords, so I then just boot of a Knoppix Live CD and have free reign to look over the entire hard drive, of what turned out to be a PA's computer, complete with photos of the vehicle parts machine plants they were building right up until they went under...
The saddest part was looking through the 'Recent Documents' list.
Letter x, letter y for boss, travel iteneries etc... then... typing tests... job guides, and finally the resume...
So sad... I wiped it good and proper before I gave it to who it was intended.