Slashdot Mirror
Ask Slashdot: How To Deal With Refurbed Drives With Customer Data?
An anonymous reader writes "I just received 3 'refurbished' SATA drives from Newegg. All 3 had some sort of existing partition. Most appeared to be factory diagnostic partitions, but one had a full Dell Windows XP install complete with customer data. How big a deal is this? Should I contact someone besides Newegg about this?"
First, have a look at the data. Then decide.
Choice #1: Send the drives back and demand ones without confidential data on them.
Choice #2: Use a utility like HDDErase which uses low level ATA commands to tell the controller to wipe the drive. This will wipe every sector, even ones that are bad, relocated, or protected ones. After that, follow up with DBAN for good measure.
After that, don't worry about it.
http://dban.org/
Enough said.
Music is everybody's possession.
It's only publishers who think that people own it.
Fuck Beta
~John Lenno
Technically it qualifies as a Data Breach Incident. Depending on the industry the original drive belonged to shit could hit the fan.
The fault lies entirely with the original owner for not wiping the hard drive before returning the equipment. NewEgg is ot in the data wiping business.
Of course the easiest thing for you to do would simply be to repartition it and reformat it.
Why bother? Ignore it. Dumb question. Move on.
I've gotten drives I purchased as new from Amazon and Newegg with exsiting Windows installations on them. In fact, I'd say I see it maybe once in every 30 drives I get. I buy enough drives that I see six or seven such drives in a typical year. Once I got a drive that was clearly part of a Windows SoftRAID before I formatted it.
Personally, I send those drives back. They clearly aren't new and they're not fit for sale in that state. I'm not paranoid enough to go looking at the SMART data for power on hours but when I run across drives like that it makes me think I should. Amazon will pay return shipping on drives in that condition. That is a good reason to buy drives from Amazon.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
I can't help but be reminded of this scene from the movie Old School:
Mitch: Sorry, your seat belt seems to be broken. What do you recommend?
Cab Driver: I recommend you stop being such a pussy. You're in the back seat.
Just don't even worry about it. Nobody you complain to is really going to care. Give it a quick scan for anything interesting, and format once you're done.
I'd ask if you can do an exchange for one with Windows 7 on it, since XP is getting pretty long in the tooth ....
Seriously though, it sounds like NewEgg is usually putting the used drives through some sort of diagnostic process, if they all had special partitions on them for the purpose. Maybe they simply need to train their bench techs to wipe the drives first, instead of making the assumption that creating the new partition is ensuring any old data on the drive becomes unreadable/inaccessible?
That is a good reason to buy drives from Amazon.
So Amazon selling used drives labeled as new is a good reason to buy from them? Sounds to me that you need a new vendor. And if you're buying 210 drives a year (one used drive every 30, and you see 7 used drives a year), I highly recommend you get some sort of direct wholesale or resellers account instead.
dd if=/dev/urandom /dev/sdx bs=4096
The solution is a little bit harder if you don't run Linux: install it first.
And people say Linux is still hard to use....
I don't respond to AC's.
First check for free porn, then call New Egg about it.
Tea and kung-fu. Life is good. Rising Phoenix
Quite a few years ago we bought an allegedly new drive from a bay area electronics retailer, and found it to contain some sort of raw partition containing a list of the names of approximately HALF THE PEOPLE in the United States along with some "number". Those of us who were listed in the data were unable to figure out what the number might be (an account number etc.)
Eventually we got bored with the data and put the drive in service for its originally intended application.
I wrote up the event and sent it off to the RISKS list, especially as Peter G. Neumann, the moderator of RISKS, was listed in the data, but they didn't publish it.
G.
I assume you don't have any LEGAL obligation to do anything other than not try to view the data. If you have any reason to suspect otherwise, ignore this entire Slashdot threat and call a lawyer.
Now the question is, how much do you WANT do do, which boils down to "at least as much as your conscience requires" and "not so much work that you'll wish you'd never ordered the drive in the first place."
At the low end of the stress scale, take an earlier poster's suggestion and use HDDErase or something similar followed by DBAN should make sure you don't ever stumble across their data. Sending it back to NewEgg accomplishes the same thing.
If you send it back, I wouldn't use the normal return method. Instead, I'd write a letter to a high-level executive and include a copy of the drive-plate cover, a screen-shot, and a copy of your order along with a request that the executive do what it takes to make sure this never happens again, then ask for instructions to return the drive. Send the letter by certified mail. Keep copies of all correspondence.
At the high end of the stress scale, you can probably complain to a government agency, as NewEgg may have violated the law.
There are other options in between.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Order more drives. Hope for jackpot.
-- Technology for the sake of technology is as pathetic as eschewing technology because it's technology.
You'd be surprised.
Long time ago I temp'd at a place that did computer recycling for various companies, mostly for a company that was a large depot of home supplies...Turns the hard drive security wipes were a "dog and pony show", to quote the supervisor. I was instructed to run the formatting utility for about 5 seconds, and then hit cancel and throw it in the "done" pile. "That gets the first part of the drive, the rest doesn't matter."
The people that do this kind of thing have hundreds of drives to do for the day, and there is no QA, so throwing a few in the done pile without clearing it just makes you look good for being extra productive, and nobody gives a shit about the data. Never cheated myself, though I probably should have. I was fired after two weeks, go figure.
The real path to male liberation
Someone along the chain swapped the RMA'd drive for one they had hanging around. They get a refurbed drive with (hopefully) more lifetime left before failure (and the ability to return it if it does die), you get a ticking time bomb and no warranty.
If I have a HD that has failed I pull the disks out and use them for Christmas ornaments. I don't trust sending them back. The rare earth magnets are useful too.
I once had to wipe some disks before throwing them out (nothing really sensitive or important). But they were SCSI and I didn't have a SCSI enabled PC handy and I couldn't be bothered setting something up or downing a server to do it, etc.
So I came up with a technique for making the disks safe for disposal.
First, I threw them out the 2nd story window a few times. Then I hurled them at the ground a few more times as hard as I could for good measure.
Then I put them in a plastic bag with a heap of dog shit and water, tied the bag up and put them in the bin. If anyone still wanted to try to retrieve that data, they've earned it.
True Story. Still makes me smile.
I once went over an "unwiped" drive looking for pron. What I found was a folder of "racy" photos the previous owner took. Unfortunately she was twenty years older than me, had about 200 lbs on me, and had a penchant for butternut squash, a food I can not eat to this day.
Knowledge is power, ignorance is bliss, and no amount of eye bleach will remove some images.
"I don't trust sending them back." Why should I not get a replacement when it fails during the warranty? And this is exactly ONE of the reasons why you should encrypt your data.
No decision needed. Look all you want, but the liability is on you if someone decides your computer is of interest and data is questionable. Unless you report it to vender in a verifiable way, data on the drive, even if it was not yours, is now yours in any examination. Report it in writing or no evidence will exist to point in someone else's direction for liability.
Wiping beyond technological limits of retrieval is important with both criminal liabilities and civil copyright liabilities. The odds of old data being a problem in your life may be low, but it would be icing on the cake with any situation bringing your drive to the attention of some types of investigations.
Call it paranoia if you like, but why drive around in your new used-car with a suitcase in the trunk that came with the car without knowing precisely what is inside. Remove the suitcase, or examine every square inch of it looking for contraband..
Oddly enough I have a story involving both Newegg and Memory Express.
I recently moved away from a city which was home to my favourite store (Memory Express) and needed to buy micro SD cards. I couldn't buy from ME's online store because they didn't handle my method of payment, so I bought a card from Newegg for a bit more money and a lesser known brand. (the same brand was way more money on Newegg). I tested the card, and it was a class 4 card with a class 10th label on it. Of course Newegg only refunds price not shipping, so I'm out a lot of money and still no decent SD card. I'm holding out until my next road trip.
Moral of the story: Don't trust Newegg. Even if they do return the money, they aren't worth it.