Old hard drives yield data bonanza

Two Massachusetts Institute of Technology graduate students have uncovered a treasure trove of personal and corporate information on used disk drives.

Simson Garfinkel and Abhi Shelat, students at MIT?s Laboratory of Computer Science, said Wednesday that they bought 158 disk drives for less than $1,000 on the Web and at swap meets.

Scavenging through the drives, they found more than 5,000 credit card numbers, medical reports, detailed personal and corporate financial information, and several gigabytes worth of personal e-mail and pornography.

Their findings, titled "Remembrance of Data Passed: A Study of Disk Sanitation," are being published in the January/February 2003 issue of IEEE Security and Privacy, a journal published by the IEEE Computer Society.

The research indicates that the market for used hard drives is flooded with devices brimming with confidential information that could be exploited. Such data, for example, could be used to assume someone else?s identity.

"The industry has known this is a problem, but our contribution is to show the pervasiveness of the problem," Garfinkel said. "You pick up 10 drives on the used market and the chances are that three or four of them are going to have confidential information. That is astounding."

Each year, as the storage capacity multiplies onto ever smaller spaces, old drives are replaced. More than 150 million disk drives were pulled from their primary service in 2002, up from 130 million in 2001, according to market research firm Dataquest.

Data dump
	These are some tools that can be used to erase hard drives.
	Name				Cost				Platform
	CyberScrub				$39.95				Windows
	DataScrubber				$1,695				Windows, Unix
	DataGone				$90				Windows
	Eraser				Free				Windows
	SecureClean				$49.95				Windows
	Unishred Pro				$450				Unix and PC Hardware
	Wipe				Free				Linux
	Wiperaser XP				$24.95				Windows
	SOURCE: IEEE Security and Privacy magazine

Garfinkel and Shelat found 129 of the 158 drives they acquired were still functional. Of these, the researchers found 28 drives in which little or no attempt was made to erase the information. On one drive, the pair found a year?s worth of financial transactions. Shelat said the drive apparently came from an automatic teller machine in Illinois.

"Right now there is no way to erase the information on the drive without plugging it in and spending dozens and dozens of minutes erasing it--and that is an expensive process," Garfinkel said. "In many cases it is going to cost more to (cleanse) the drive than the drive is even worth."

The pair found that most attempts to erase information from the drives before selling them were ineffectual. On many disks, the files that once resided in the "My Document" folder had been deleted but could easily be recovered using the "undelete" utility. Many computer users are unaware that deleting a file does not actually overwrite the blocks on the disk that hold that information.

Even a reformatted drive is vulnerable.

Although 60 percent of the drives had been formatted before being sold, the researchers noted that formatting does not fully sanitize a disk because Microsoft?s Window?s "format" command doesn?t overwrite every block of data.

"The format command just reads every block to make sure that they still work," explained Garfinkel. "To properly sanitize the hard drive, you need to overwrite every block."

It was on one of these formatted drives that the pair found 5,000 credit card numbers.

The students found that only 12 drives were properly sanitized.

"Lots of people know it is important to clean drives before you repurpose them, but few people do it because it's hard to do," Garfinkel said.