The 2009 Analysis of Information Remaining on Disks Offered for Sale on the Second Hand Market

Abstract

The ever increasing use and reliance upon computers in both the public and private sector has led to enormous numbers of computers being disposed of at the end of their useful life within an organisation. As the cost of computers has dropped, their use in the home has also continued to increase. In most organisations, computers have a relatively short life and are replaced on a regular basis with the result that, if not properly cleansed of data, they are released into the public domain containing data that can be relatively up to date. This problem is exacerbated by the increasing popularity and use of smart phones, which also contain significant storage capacity. From the results of the research it remains clear that the majority of organisations and private individuals that are using these computers still remain ignorant or misinformed of the potential volume and type of information that is stored on the hard disks contained within these systems. The evidence of the research is that neither organisations nor individuals have considered, or are aware of, the potential impact of the information that is contained in the disks from these systems becoming available to an unintended third party. This is the fifth study in an ongoing research programme being conducted into the levels and types of information that remain on computer hard disks that have been offered for sale on the second hand market. This ongoing research series has been Journal of Digital Forensics, Security and Law, Vol. 5(4) 44 undertaken to gain an understanding of the level and types of information that remains on these disks, to determine the damage that could potentially be caused if the information was misused, and to determine whether there are any developing trends. The disks used have been purchased in a number of countries. The rationale for this was to determine whether there are any national or regional differences in the way that computer disks are disposed of and to compare the results for any regional or temporal trends. The disks were obtained from a wide range of sources in each of the regions in order to minimise the effect of any action by an individual source.The first study was carried out in 2005 and since then has been repeated annually with the scope being incrementally extended to include additional research partners and countries. The study in 2009 was carried out by British Telecommunications (BT) and the University of Glamorgan in the UK, Edith Cowan University in Australia, Khalifa University in the United Arab Emirates and Longwood University in the USA.The core methodology of the research has remained unaltered throughout the duration of the study. The methodology has included the acquisition of a number of second hand computer disks from a range of sources and determining whether the data contained on the disks has been effectively erased or if they still contain information relating to previous owners. If information was found on the disks from which the previous user or owner could be identified, the re...

Electronic retention: what does your mobile phone reveal about you?

“…Firstly, we provide detailed documentation of a method for surveying the extent of artifacts retained on resold mobile devices. The method described adapts that used in related studies for examining the information contents of resold hard disks and flash media devices [10,11] to the context of mobile devices. The documentation of the method supports repeatability in the future, as well as easing comparison should variants of the experiment be conducted (with different sources of devices, different localities, or the use of different forensic toolkits, for example).…”

The Impact of Hard Disk Firmware Steganography on Computer Forensics

“…When wiping the disk the sectors in the error lists are not seen by the operating system so data may be left on these bad sectors. Disk disposal has been documented as a significant issue [9], [10], [11] and traditional disk disposal tools may not be aware of this feature of a disk drive. The firmware in these disks may fail.…”

Analysis of Data Remaining on Second Hand ADSL Routers

“…A large focus of current research is centred around remanent data on hard disks, USB drives and gaming consoles sold through second hand auction websites (Jones, Valli, & Dabibi, 2009;Valli & Woodward, 2008;Xynos, Harries, Sutherland, Davies, & Blyth, 2010). This previous research has identified a continuous trend in sellers leaving confidential data on the devices intact.…”

“…This previous research has identified a continuous trend in sellers leaving confidential data on the devices intact. In a few rare occurrences sellers format the storage media, but do not use an appropriate method by which to wipe or destroy the data permanently (Jones, et al, 2009). …”