Data Recovery: Please Wipe Your Drives
A second-hand hard drive, 170,000 recoverable files, and a stark reminder that a quick format is not a secure wipe.
If you’re planning on recycling or selling or trading or anything-ing your old computer, phone, camera, SD card, floppy disk, magnetic tape, or punch cards, make sure you erase the data properly first. If you don’t, you’ll leave a potentially shocking amount of information about you available to whomever picks that drive up. As you will see momentarily in this case study…
I picked up a 1.5TB Seagate Barracuda drive second hand. I got it from a well-known electronics store. I do this thing where I buy up old, used drives and do some data recovery on them to see if I can find anything interesting. It’s like detective work, but with lower stakes.
This particular drive had a lot of data left on it. It had been quick formatted, so the MFT was gone and the drive appeared empty, but in reality, a quick format is not a proper wipe, and over 170,000 files were still left sitting on the drive. This was by far the biggest haul I’ve had from any drive that I’ve taken a look at so far, and, had this drive been picked up by someone with worse intentions, it could have ended disastrously for the previous owner, who we’ll call Mr(s) XYZ.
Mr(s) XYZ seems to have used this computer at least between 2011 and 2017. Whether it was purchased new or second hand I’m not sure. And what the drive at least has been doing for almost 10 years, I’m not sure either. It wasn’t in good condition, there were a number of read errors while trying to recover the data and a number of bad sectors that made a large portion of the drive unusable.
If this was sold by the original owner within a reasonable time of my buying it, then it shouldn’t have ever been sold to me. A pretty basic check of the drive would have revealed the health issues.
But that’s by-the-by. The real interesting bit is what I found on the drive. And boy howdy was there a lot. There was more than enough personal information for me to very very easily steal Mr(s) XYZ’s identity, and the identities of their two children. Multiple national insurance numbers, birth certificates, passports, driving licences, CVs, correspondence to/from Mr(s) XYZ about work. Home office correspondence, tax office correspondence, rental agreements, family photos, school projects, and a truly industrial quantity of porn. Like, good lord there was a lot of porn. Like, seemingly trying to archive all of xhamster circa 2015.
Should I have had bad intentions, I could have made at least 3 people’s lives a living hell with the information left on this drive. More than enough to apply to the passport office or DVLA and get identification documents sent to me. Bank details, insurance policy information, pension scheme details. All sitting there, waiting for someone to dig them out. And digging them out isn’t exactly a challenge.
The takeaway
The moral of this story is really just to wipe your drives properly when you dispose of them. I have no doubt that Mr(s) XYZ did not want me to see their driving licence and the frankly scary amount of pornography that can fit into 1.5TB.
So if you are getting rid of your old devices, make sure you wipe them properly. For most modern phones, a factory reset will genuinely work fine. Most phones from the last 5-8 years use a sort of full disk encryption, where everything on the phone is encrypted, and a factory reset deletes the decryption key. So that data is there, but it is virtually impossible for anyone to ever read it for ever and ever and ever amen.
If you’re getting rid of a computer, check what kind of disk it has. If you have an HDD, use a tool like DBAN or nwipe or the shred command in Linux. For SSDs, it’s best to check the manufacturer’s instructions, since the exact mechanism will vary depending on who built your SSD. Although, nwipe will be able to securely erase most SSDs as well.