Residual Data on Used Equipment
Used hard drives are frequently a good source of images for testing forensic tools. That's because many individuals, companies and organizations neglect to properly sanitize their hard drives before they are sold on the secondary market.
You can find used hard drives on eBay, at swap meets, yard sales, and even on the street.
- 2009-11-21: Robert Siciliano, a security consultant to Intelius.com and personal ID theft expert, buys an ATM machine for $750 from a bar in Boston. The machine comes with more than 1000 credit and ATM card numbers. http://www.theregister.co.uk/2009/11/18/second_hand_atm_fraud_risk/
- USED memory sticks being sold on the internet have been found to contain sensitive Australian government data, according to a study Patryk Szewczyk and Krishnun Sansurooah, of the Security Research Institute at Perth's Edith Cowan University. http://www.theaustralian.com.au/technology/government-data-found-on-memory-sticks/story-e6frgakx-1226773129880
There have been several incidents in which individual have purchased a large number of hard drives and written about what they have found. This web page is an attempt to catalog all of those stories in chronological order.
- 2003-01: Simson Garfinkel and Abhi Shelat at MIT publish a study in IEEE Security and Privacy Magazine which documents large amount of personal and business-sensitive information found on 150 drives purchased on the secondary market.
- 2006-06: A man buys a family's hard drive at a fleamarket in Chicago after the family's hard drive is upgraded by Best Buy. Apparently somebody at Best Buy violated company policy and instead of destroying the hard drive, they sold it.
- 2006-08-10: The University of Glamorgan in Wales purchased 317 used hard drives from the UK, Australia, Germany, and the US. 25% of the 200 drives purchased from the UK market had been completely wiped. 40% of the purchased drives didn't work. 40% came from businesses, of which 23% contained enough information to identify the company. 5% had business sensitive information. 25% came from individuals, of which many had pornography, and 2 had to be referred to the police for suspected child pornography.
- 2006-08-14: BBC News reports on bank account information recovered from used PC hard drives and being sold in Nigeria for £20 each. The PCs had apparently come from recycling points run by UK town councils that are then "recycled" by being sent to Africa.
- 2006-08-15: Simson Garfinkel presents results of a study of 1000 hard drives (750 working) at the 2006 Workshop on Digital Forensics. Results of the study show that information can be correlated across hard drives using Garfinkel's Cross Drive Analysis approach.
- 2007-02-06: Fulcrum Inquiry, a Los Angeles litigation support firm, purchased 70 used hard drives from 14 firms and discovered confidential information on 2/3rds of the drives.
- 2007-08-30: Bill Ries-Kinght, an IT consultant, purchases a 120GB Seagate hard drive on eBay for $69. Although the drive was advertised as being new, it apparently was previously used by the campaign of Mike Beebe, who won the Arkansas state governorship in November 2006. "Among the files were documents listing the private cell phone numbers of political allies, including US Senators Blanch Lincoln and Mark Pryor and US Representatives Marion Berry, Mike Ross and Vic Snyder. It also included talking points to guide the candidate as he called influential people whose support he sought," states an article published in The Register.
- 2008-01-28: Gregory Evans, a security consultant in Marina Del Ray, Calif., bought a $500 computer at a swap meet from a former mortgage company. It contained credit reports on 300 people in a deleted file, according to an article published in The New York Daily NEws. The security consultant was also able to recover the usernames and passwords of the mortgage company's former employees.
- 2009-02-10: Michael Kessler, CEO of Kessler International, a New York City forensics firm, bought 100 "relatively modern drives, the vast majority of them Serial ATA" from eBay over the course of 6 months. The drives ranged in size from 400GB to 300GB. 40% of the drives were found to contain sensitive data. 
- 2009-05-07: University of Glamorgan bought disks in its annual survey of used hard drives and found "Details of test launch procedures for the THAAD (Terminal High Altitude Area Defence) ground-to-air missile defence system. Missile data found on hard drives, BBC News, May 7, 2009
- 2009-07-30: Reporters working for the PBS show Frontline on an article about electronic waste find hard drives in Ghana that contain "hundreds and hundreds of documents about government contracts" from a hard drive that had been previously used by a TSA subcontractor. The documents were marked "competitive sensitive" and covered contracts with the Defense Intelligence Agency. The hard drive was not encrypted. Reporters find Northrop Grumman data in Ghana market, Robert McMillan, IT World, June 24, 2009
- 2009-09-23: The Inspector General of the United States Department of Defense issues a report about the widespread sale and return of equipment containing sensitive information. Report No. D-2009-104 September 21, 2009 Sanitization and Disposal of Excess Information Technology Equipment.
- 2010-12-08: NSAS decomissions 14 computers with hard drives that "failed tests to verify data had been destroyed. The drives turn up in a dumpster with sensitive information regarding the Space Shuttle. Reported By Dan Goodin in San Francisco, The Register, 8th December 2010
- 2012-04-25: A report published by the UK Information Commissioner's Office finds that 1 in 10 hard drives sold on the secondary market contains highly sensitive information, based on a "mystery shopper" study in which an organization purchased 200 hard drives on the Internet and at used computer fairs. Sophie Curtis, "InfoSec 2012: One in 10 second-hand hard drives contain personal data, April 2012.
- 2013-07-14: UK's National Health Service Surrey was fined a £200,000 ($300,000) after it sold a hard drive that contained 3,000 patient records (2,000 children and 900 adults). Apparently the drives were provided to a PC recycler on the grounds that they be destroyed. The recycler provided a destruction certificate, then sold the drives on eBay. A member of the public bought the drive, discovered what they had, and alerted the authorities. [Source: Hospital fined £200,000 after hard drive full of patient data bought on eBay, By John E Dunn, Techworld, 14 July 2013]
- BlackBerry Reveals Bank's Secrets, Wired, August 8, 2005.
- Who has your old phone's data, Pete Warren, The Guardian, London, Sept. 28, 2008, page 13.
- McCain Campaign Sells Info-Loaded Blackberry to FOX 5 Reporter, by Tisha Thompson and Rick Yarborough, FOX 5 Investigative Unit, 11 December 2008. (See also )
- Camera sold on eBay contained MI6 files, Jessica Salter, Telegraph, September 30, 2008.
- Council sells security hole on Ebay, Matthew Sparkes, PC Pro, September 29, 2008 - Kirkless Council (UK) sells a Cisco VPN 3002 Concentrator on Ebay for 99 pence. The device is purchased by Andrew Mason, a security consultant, who discovers that the Cisco VPN device still has the full configuration for the Kirkless Council and the device hasn't been deactivated.
- NZ man's MP3 player holds US military files, Associated Press, Jan 27, 2009. A man from New Zealand bought an MP3 player at a thrift shop in Oklahoma that had 60 US military files, "including names and telephone numbers for American soldiers."
Andy Jones, Glenn Dardick, Gareth Davies, Iain Sutherland, Craig Valli - The 2008 Analysis of Information Remaining on Disks Offered for Sale on the Second Hand Market
- Journal of International Commercial Law and Technology 4(3),2009
BibtexAuthor : Andy Jones, Glenn Dardick, Gareth Davies, Iain Sutherland, Craig Valli
Title : The 2008 Analysis of Information Remaining on Disks Offered for Sale on the Second Hand Market
In : Journal of International Commercial Law and Technology -
Date : 2009