Data Backup Digest

New research carried out by Kroll Ontrack has found that nearly half of second hand storage devices contain personal information about their previous owners.

The discovery was published as part of a global security study that aimed to explore how private personal information was when stored on consumer storage devices.

The firm purchased 64 drives from second-hand marketplace eBay. The drives came from all over the world, including the United Kingdom, United States, Italy, France, Germany, Poland and the Asia-Pacific region.

They then analysed these drives to see whether people had adequately erased the storage devices before selling them on. They found that around half of the drives still contained sensitive information about the people who used to own them, allowing them to find out about their identities.

Some of the drives contained business information like usernames, address, bank details and phone numbers. One drive even had job titles, language abilities, vocation dates and more, presumably about their employees or customers. Not only does this put those individuals at risk, but it also risks harming the reputation of the company.

Around a third of the devices had personal photos, videos, music, emails and documents. Login information for online accounts were found on eight of the drives. They also uncovered transactional details, like salary statements, bank numbers, tax returns and more on nine drives.

Although the previous owners of these drives had attempted to wipe the data on them, if not done properly then it can be possible to recover some or all of the data that used to be stored, as Kroll Ontrack discovered.

Their study involved both hard disk drives and solid state drives. The latter is becoming a more popular option, thanks to the growing capacity offerings and lower price point. Although SSDs are by no means invulnerable to the challenges of data wiping, it did seem that they were better at destroying previous data.

“Ontrack recently carried out a global security study that indicated we are putting our personal information at risk far too easily,” said the company in a statement. “Among the drives Kroll Ontrack examined, traces of data were found on nearly half. Many of these innocent oversights allowed the new owners critical access into the previous owners' identity.”

They found that if you want to sell your drive, the best way to ensure that the data on it is deleted is to a low-level format. This involves pattern falling and can send the drive back to factory settings. Typically, when you remove data from a drive the space that it occupied is marked as available for something else to write over it. However, if it isn’t rewritten, the data can be recoverable. As such, the formatting process is one that will constantly rewrite to the drive so that no actual data can be recovered.

If your drive was used in an enterprise setting, you may want to consider whether it might be a better idea to physically destroy the drive altogether, just for peace of mind.