Slashdot Mirror
Ask Slashdot: How To Deal With Refurbed Drives With Customer Data?
An anonymous reader writes "I just received 3 'refurbished' SATA drives from Newegg. All 3 had some sort of existing partition. Most appeared to be factory diagnostic partitions, but one had a full Dell Windows XP install complete with customer data. How big a deal is this? Should I contact someone besides Newegg about this?"
Choice #1: Send the drives back and demand ones without confidential data on them.
Choice #2: Use a utility like HDDErase which uses low level ATA commands to tell the controller to wipe the drive. This will wipe every sector, even ones that are bad, relocated, or protected ones. After that, follow up with DBAN for good measure.
After that, don't worry about it.
http://dban.org/
Enough said.
Music is everybody's possession.
It's only publishers who think that people own it.
Fuck Beta
~John Lenno
Darik's Boot And Nuke | Hard Drive Disk Wipe and Data Clearing
www.dban.org/
Just wipe the drive and move on. You don't want to know, and it's too much hassle besides.
Why bother? Ignore it. Dumb question. Move on.
I've gotten drives I purchased as new from Amazon and Newegg with exsiting Windows installations on them. In fact, I'd say I see it maybe once in every 30 drives I get. I buy enough drives that I see six or seven such drives in a typical year. Once I got a drive that was clearly part of a Windows SoftRAID before I formatted it.
Personally, I send those drives back. They clearly aren't new and they're not fit for sale in that state. I'm not paranoid enough to go looking at the SMART data for power on hours but when I run across drives like that it makes me think I should. Amazon will pay return shipping on drives in that condition. That is a good reason to buy drives from Amazon.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
I can't help but be reminded of this scene from the movie Old School:
Mitch: Sorry, your seat belt seems to be broken. What do you recommend?
Cab Driver: I recommend you stop being such a pussy. You're in the back seat.
Just don't even worry about it. Nobody you complain to is really going to care. Give it a quick scan for anything interesting, and format once you're done.
I think this is yet another reason full disk encryption should just become the norm for people storing sensitive data.
I assume you don't have any LEGAL obligation to do anything other than not try to view the data. If you have any reason to suspect otherwise, ignore this entire Slashdot threat and call a lawyer.
Now the question is, how much do you WANT do do, which boils down to "at least as much as your conscience requires" and "not so much work that you'll wish you'd never ordered the drive in the first place."
At the low end of the stress scale, take an earlier poster's suggestion and use HDDErase or something similar followed by DBAN should make sure you don't ever stumble across their data. Sending it back to NewEgg accomplishes the same thing.
If you send it back, I wouldn't use the normal return method. Instead, I'd write a letter to a high-level executive and include a copy of the drive-plate cover, a screen-shot, and a copy of your order along with a request that the executive do what it takes to make sure this never happens again, then ask for instructions to return the drive. Send the letter by certified mail. Keep copies of all correspondence.
At the high end of the stress scale, you can probably complain to a government agency, as NewEgg may have violated the law.
There are other options in between.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
You'd be surprised.
Long time ago I temp'd at a place that did computer recycling for various companies, mostly for a company that was a large depot of home supplies...Turns the hard drive security wipes were a "dog and pony show", to quote the supervisor. I was instructed to run the formatting utility for about 5 seconds, and then hit cancel and throw it in the "done" pile. "That gets the first part of the drive, the rest doesn't matter."
The people that do this kind of thing have hundreds of drives to do for the day, and there is no QA, so throwing a few in the done pile without clearing it just makes you look good for being extra productive, and nobody gives a shit about the data. Never cheated myself, though I probably should have. I was fired after two weeks, go figure.
The real path to male liberation
If I have a HD that has failed I pull the disks out and use them for Christmas ornaments. I don't trust sending them back. The rare earth magnets are useful too.
Looking at the data legally puts you at risk. The other company may care. If the data was government/military, there's a headache you don't want. Erase it immediately so there is no question. While no one can prove you looked at it or not, no need to make it worse on you.
Well, there's spam egg sausage and spam, that's not got much spam in it.
This generally makes it hard to exercise the manufacturer's warranty on a broken drive, though.
"I don't trust sending them back." Why should I not get a replacement when it fails during the warranty? And this is exactly ONE of the reasons why you should encrypt your data.
First: that shouldn't happen. I'm not saying it doesn't or won't, but if people are following the rules it shouldn't.
Second: classified documents are marked as such, top and bottom of every page.
Third: if you you do happen to see documents marked as classified, close them immediately (even if you have security clearance), power down the machine, put the drive in a safe, secure place, and contact someone. It really doesn't matter who, you'll get to the person you need to eventually even if you just call the local police department but you'd probably be better off looking up a general contact number for the DoD.
And for everyone out there who says "Just delete it! Contacting someone is just going to cause problems!", there are 2 things to consider. First, the information never should have been on the drive anyway. If somewhere down the line an investigation gets fired up to go into where all those missing drives went you can bet your ass they'll be knocking on your door, taking your drives (probably more than just the refurbished one), and asking a lot of questions (that are a lot easier to answer honestly than with little white lies). Second, most classified information is classified for a reason. If someone out there is selling drives with classified information on them, that's what we call a bad thing. Yeah, it's going to be a headache for you, but it's the kind of thing that really shouldn't be happening.