Erase Your Hard Disk: The Cold, Hard Drive Facts

Better think twice before you give your hard drive away. According to a new study by two MIT grad students, companies are frequently selling or giving away old computer disk drives with sensitive information still on them.

The study, which is detailed in the report, “A Remembrance of Data Passed: A Study of Disk Sanitization Practices,” analyzed 158 disk drives purchased through eBay, at computer stores and salvage companies.

The data retrieved included detailed personal and corporate financial records, medical records, and personal e-mail, according to MIT grad student Simson Garfinkel (a contributor to CSO), who conducted the study with Abhi Shelat.

Financial log files on one drive yielded what appeared to be 2,868 credit card numbers in addition to bank account numbers, dates of transactions and balances. The students think the drive came from an ATM in Illinois and that no effort was made to remove the financial information prior to resale.

The recovered data problem stems from failures on the part of computer vendors and consumers alike. Companies such as Microsoft are guilty of misrepresenting their products’ “file delete” and “disk format” features, according to Garfinkel.

Casual computer users often assume that such features permanently delete the data stored in a file from the disk drive. Instead, most simply change the data to indicate that the file has been deleted, then mark the areas of the hard disk that contain the “deleted” data as being available for reuse by other programs. Assuming that data is not overwritten, it remains and can be retrieved using simple Unix commands or free commercial forensic software tools, Garfinkel says.

Operating system vendors should include software-based tools that securely delete files and sanitize the disk space they leave behind, the report says. The manufacturers of disk drives should also embrace existing technologies such as cryptographic subsystems that encrypt information using a secret key as it is written to the hard disk and decrypt it when it needs to be viewed.

In the meantime, organizations need to adopt consistent policies to sanitize hard drives that are sold, destroyed or reused.

For more on how information is stored on hard drives, read “Tools of Evidence,” Machine Shop.