Hard drives offer up secrets

Second-hand PC can be full of sensitive info

Computers users must clean up their act if they do not want their data falling into the wrong hands.

The warning comes after two computer science students found a wealth of confidential information on discarded computers.

The graduates from the Massachusetts Institute of Technology decided to find out just how many secrets the mountain of PCs thrown away every day could tell about their previous owners.

The answer seems to be a great deal.

Secrets unveiled

Simson Garfinkel and Abhi Shelat found that even computers with supposedly erased disk drives were full of sensitive data such as credit card numbers, medical records and e-mails.

There have been a number of cases, which haven't reached the press, where companies have been caught out

Clive Carmichael-Jones, Vogon

"There are many stories in which somebody has bought a used computer and found confidential information on it," said Mr Garfinkel.

"Nobody has ever quantified the scale of the problem so we decided to find out," he added.

Their research suggests that the second-hand market is awash with confidential information.

They bought 158 disk drives for less than $1,000 from eBay and other sources of used computer hardware.

Out of these, 129 were functional and there had been little or no attempt to erase information on 28 of these.

One of the drives had come from an ATM machine in Illinois and contained a year's worth of financial transactions.

Another disk contained 5,000 credit card numbers. Others showed up medical records and gigabytes of personal e-mail and pornography.

Only 12 had been properly cleaned.

Even disks that contained no files and could not be incorporated on a computer could still have data retrieved using special tools.

Balancing act

Clive Carmichael-Jones, operations director at data recovery firm Vogon believes the scale of the problem is only beginning to be realised.

"There have been a number of cases, which haven't reached the press, where companies have been caught out," he said.

There is a common misconception that formatting a disk means it is empty

Phil Bowles, DataSec

While some companies go to the extremes of physically destroying the disk drives of old PCs and others use data erasing software, a significant number do nothing.

"It is a balancing act between the value of the data and the cost of doing something about it," he said.

As more companies recycle their old PCs to local schools and community groups it becomes ever more important to make sure disks are clean of sensitive information before they go to their new homes.

Consumers too need to be aware of what may still lurk on PCs they decide to sell on.

Hammer option

"There is a common misconception that formatting a disk means it is empty," said Phil Bowles, Forensic Analyst at DataSec.

"It may appear that it is empty and the machine won't even start up again but the data can be recovered within minutes," he said.

To be confident information is gone, users need to get their hands on wiping software, readily and cheaply available on the internet said Mr Bowles.

"Or alternatively they could hit it with a mallet. That should do it," he added.

The research by the MIT students is published in the January/February issue of US-based IEEE (Institute of Electrical and Electronic Engineers) Security and Privacy magazine.