Online Thrift Stores Have Your Data
by base64xor
When it is decided that a PC or laptop is of no use, do individuals or organizations alike dispose of or resell the system and the hard drives? From reviewing online offers, there are those that decide to resell or donate the system or drives to a thrift reseller.
Perhaps you have used a computer or uploaded a file to a computer of a friend or family member, at a library, a photo kiosk, a print store, or other fine establishments. When those systems are of no use, the system or hard drives from that system may be donated to a thrift store. You may have personal data at risk of exposure to others unknown to you and outside of your control.
So are hard drives that are sold by a thrift reseller routinely wiped of all data? Could one buy hard drives from an online thrift store and then recover files from the hard drive? To determine how easy it is to recover files from used drives bought at a thrift store, I decided to buy a few hard drives online and attempt to recover data.
To start off this research, I picked a popular website that sells hard drives from locations around the country. I selected two older Western Digital drives that were offered from a thrift store in South Florida. I purchased the two drives for $21 including shipping and handling.
Description: WD Caviar SE 250 GB & 320 GB Desktop Hard Drives Brand: Western Digital Condition: No visible damages. Items tested and formatted multiple times Partition Tablet Type: MBR File System Type: NTFSThe online description of the hard drives stated the drives were "formatted several times," so perhaps the data was wiped before the drives were placed for sale. But of course, formatting does not erase data. In order to temporarily connect the drives externally to a computer, I purchased a USB-to-SATA cable kit at an online store for under $10.
I needed the kit in order to connect the drives to an older iMac of mine that is running the Ubuntu MATE Linux distribution. When the drives arrived, I connected the first drive to my iMac. The cable kit worked, and the Ubuntu MATE system recognized the hard drive.
The Linux file explorer displayed an empty folder for the hard drive. Nothing there, no files present! So I needed to install a program designed to recover deleted data. In order to attempt data recovery from the hard drives, I installed the program Foremost which allows for recovery of deleted files from a device or disk image.
The command that I ran to install foremost:
After the program was installed, I then ran a foremost command to recover office files:
Foremost ran for one hour and 18 minutes, and created a directory called "output" with subdirectories of file types and the audit.txt file. The program recovered 123 Office files. Since the recovery of the Office files answers my question as to whether the disk was wiped, I did not attempt to recover additional file types.
Extracted from the audit file:
I disconnected the first drive and then connected the second drive to my iMac. Once again, the system displayed an empty folder when I first connected the drive. I then ran the same Foremost command to recover Office files, and the program ran for two hours and 40 minutes, recovering 1,321 Office files.
Extracted from the Audit file:
So from this research, I found that online thrift stores may sell hard drives that are not zeroed of all data. I was able to recover Office files from both hard drives. In order to ensure that all data is wiped from a hard drive, a program must be used which writes data across the entire disk several times. Such a program is usually described as meeting U.S. government specifications for erasing digital data from storage devices. In this case, the drives were not wiped of data and I demonstrated how easy it is to recover files.
So think twice before you use a computer system that is not or will not remain under your direct and personal control until the hard drives are either destroyed or properly wiped of data.