ITWales.com

Sex, Spies and Hard-Drives

by Simon Steggles

On average, 70% of re-sold hard-drives and memory cards contain pornographic material according to research carried out on 1,000 hard-drives over the course of a year by Disklabs Data Recovery and Computer Forensics.

In addition, the company recently purchased a selection of storage media comprising of 100 hard-disk drives and 50 memory cards and proceeded to process a sample batch to test what data was still retrievable from them. The results were worrying as documents such as CVs and accounting spreadsheets (including names and mobile numbers) were easily accessible.

Perhaps even more worrying was the fact that many previous owners had not deleted temporary Internet files. This means that any new, unscrupulous owner could access personal financial details, such as credit card numbers and could then go on to order goods from Internet pages by simply changing the delivery address. Many of the sampled selection also contained pornographic matter.

It seems that very few people are aware that simply pressing the delete button does not necessarily mean that the data is destroyed and irretrievable. This research comes as a timely reminder to both consumers and businesses that data should be destroyed properly and not simply deleted or formatted, as this is not sufficient to completely erase stored data.

Disklabs have since contacted all of the owners of the hard-drives and memory cards that data was retrieved from to inform them that their old media still contained retrievable data. It must be stressed that all these storage devices have now all been properly wiped by 1st Computer Traders Ltd and the devices are now being used as spare parts for further data recovery tasks sent in to Disklabs Data Recovery and Computer Forensics Services.

Relevant points to bear in mind include,

1. The company that we bought the entire selection of products from was eBay
2. Most of the traders who sold us the goods didn't care that the data wasn't wiped properly - 1 of them told me just to delete everything and sell it back on eBay!
3. Don't trust a trader to wipe any data from your computer. Nearly all the ones that successfully removed data had a common denominator; they were members of the PC Association and as such were bound by the PCA's Code of Conduct
4. 70% of all Data Recovery jobs have pornography on them. We know this because one of the best ways of checking the integrity of files is by viewing images or movies. If a picture of the seaside has a big black line through the middle of it, it is likely that there is still a corruption etc.
5. We come across approximately 2 pedophile cases per year. These are immediately passed over to the relevant police authorities
6. Mobile phones are now recoverable. Mobile phone SIM/USIM cards and phone bodies are recoverable, and if required, forensic reports can also be produced
7. Most of the pornography on Mobile Phones is generally taken by the phone owner themselves, rather than the standard 'download stuff'

The moral of the story is,

• If you want your data wiped properly, use an expert. Do not rely on traders who offer to do it for you. We know that about 30% of them wont bother or do a 'botch job' of it
• Data is NEARLY ALWAYS RETRIEVABLE. If you need data recovering, simply send it to a specialist, rather than someone who thinks that they are, or says he will have a go first. This will nearly always make the job more difficult for the professionals and most likely more expensive
• Mobile Phones can be recovered from, as can PDA's and other hand held devices
• Only buy from or trade with members of the PC Association

Simon Steggles is from Disklabs Data Recovery and Computer Forensics Services. Disklabs will be exhibiting at Business Continuity - The Risk Management Expo 2007. The UK's most definitive event for managing risk, resilience and recovery combining an exhibition, free seminars and a paid for high level conference. It will be held at London's Excel, Docklands from 28-29 March 2007. To register please visit www.businesscontinuityexpo.co.uk.

Useful Links:
www.disklabs.com
www.mobilephoneforensics.com
www.1ct.com
www.pcassoc.org

Send a comment about this article to editor@itwales.com.