‘Sanitized’ hard drives reveal secrets

ToshiroOC · Jan 16, 2003, 05:51 AM

By MSNBC.com
-----
OVER TWO YEARS, Simson Garfinkel and Abhi Shelat assembled a collection of 158 used hard drives, shelling out between $5 and $30 for each at secondhand computer stores and on eBay.
Of the 129 drives that functioned, 69 still had recoverable files on them and 49 contained “significant personal information” — medical correspondence, love letters, pornography and 5,000 credit card numbers. One even had a year’s worth of transactions with account numbers from an ATM in Illinois.
“On that drive, they hadn’t even formatted it,” Garfinkel said. “They just pulled it out and sold it.”
About 150,000 hard drives were “retired” last year, the research firm Gartner Dataquest estimates. Many ended up in trash heaps, but many also find their way to secondary markets.
Over the years, stories have occasionally surfaced about personal information turning up on used hard drives that have raised concerns about personal privacy and identity theft risks.
Last spring, the state of Pennsylvania sold to local resellers computers that contained information about state employees. In 1997, a Nevada woman purchased a used computer and discovered it contained prescription records on 2,000 customers of an Arizona pharmacy.
Garfinkel and Shelat, who report their findings in an article to be published Friday in the journal IEEE Security & Privacy, say they believe they’re the first to take a more comprehensive — though not exactly scientific — look at the problem.

Article can be read here.

Vampyromaniac · Jan 16, 2003, 07:40 AM

Yes, so when selling a HDD, always remember to wrtie 0's all over it, with a black marker

ktbhannible · Jan 18, 2003, 05:01 AM

Also use programs like "Evidence Eliminator" which uses DOD Department of Defence erasing standards.

Matth · Jan 18, 2003, 03:26 PM

A few hd diagnostic programs can zero fill.

A "poor mans" method...
Create some large blank bitmap files, and compress them onto a floppy - you can fit at least a gigabyte, and room for an extraction program (or SFX).

Now format or delete all files on the HD to be cleaned, and then unpack the fillers - to multiple directories until full.

It might miss a few little bits, and it's only a single overwrite - but practically, unless the drive is to be forensically examined, a single overwrite will prevent the data being found with the drive in any normal PC.

Just formatting, is not much better than leaving all the files intact!

I believe a "pocket Linux" like "tom's rootboot floppy" can also be used to zero-fill a HD - the control you have over devices is frightening!

AHA!
http://dban.sourceforge.net/
A freeware HD nuker

Also available as part of:
http://www.heidi.ie/eraser/
For other erasing tasks.

Ideal for those celebrities worried they might be next for a knock om the door.

Jan 16, 2003, 05:51 AM	#1
ToshiroOC Unbiased. Join Date: Jun 2002 Posts: 4,812 Rep Power: 0	‘Sanitized’ hard drives reveal secrets By MSNBC.com ----- OVER TWO YEARS, Simson Garfinkel and Abhi Shelat assembled a collection of 158 used hard drives, shelling out between $5 and $30 for each at secondhand computer stores and on eBay. Of the 129 drives that functioned, 69 still had recoverable files on them and 49 contained “significant personal information” — medical correspondence, love letters, pornography and 5,000 credit card numbers. One even had a year’s worth of transactions with account numbers from an ATM in Illinois. “On that drive, they hadn’t even formatted it,” Garfinkel said. “They just pulled it out and sold it.” About 150,000 hard drives were “retired” last year, the research firm Gartner Dataquest estimates. Many ended up in trash heaps, but many also find their way to secondary markets. Over the years, stories have occasionally surfaced about personal information turning up on used hard drives that have raised concerns about personal privacy and identity theft risks. Last spring, the state of Pennsylvania sold to local resellers computers that contained information about state employees. In 1997, a Nevada woman purchased a used computer and discovered it contained prescription records on 2,000 customers of an Arizona pharmacy. Garfinkel and Shelat, who report their findings in an article to be published Friday in the journal IEEE Security & Privacy, say they believe they’re the first to take a more comprehensive — though not exactly scientific — look at the problem. Article can be read here. __________________ [img][/img] [color=White]Peace be with you, Joe.[/color] Driverheaven Staff Member (Supermoderator)

Jan 18, 2003, 03:26 PM	#4
Matth Flash Banner Hater Join Date: Jun 2002 Location: UK Posts: 3,426 Rep Power: 93 System Specs	A few hd diagnostic programs can zero fill. A "poor mans" method... Create some large blank bitmap files, and compress them onto a floppy - you can fit at least a gigabyte, and room for an extraction program (or SFX). Now format or delete all files on the HD to be cleaned, and then unpack the fillers - to multiple directories until full. It might miss a few little bits, and it's only a single overwrite - but practically, unless the drive is to be forensically examined, a single overwrite will prevent the data being found with the drive in any normal PC. Just formatting, is not much better than leaving all the files intact! I believe a "pocket Linux" like "tom's rootboot floppy" can also be used to zero-fill a HD - the control you have over devices is frightening! AHA! http://dban.sourceforge.net/ A freeware HD nuker Also available as part of: http://www.heidi.ie/eraser/ For other erasing tasks. Ideal for those celebrities worried they might be next for a knock om the door. Last edited by Matth; Jan 18, 2003 at 04:31 PM.

Jan 16, 2003, 07:40 AM	#2
Vampyromaniac confutatis maledictis Join Date: May 2002 Location: somewhere dark Posts: 5,974 Rep Power: 77 System Specs	Yes, so when selling a HDD, always remember to wrtie 0's all over it, with a black marker

Jan 18, 2003, 05:01 AM	#3
ktbhannible DriverHeaven Junior Member Join Date: Oct 2002 Posts: 36 Rep Power: 0	Also use programs like "Evidence Eliminator" which uses DOD Department of Defence erasing standards.