One in Three Used Drives Not Secure

A data recovery firm says it found 3.1 million "deleted" files on a second-hand hard drive. It also found 35 percent of drives had readily-restorable files.

The experiment by Secure Data Recovery comes with an obvious warning. It's a company that helps people recover deleted or corrupted files from their own drives, so it has an interest in highlighting that such recovery is possible.

That said, in this experiment conducted for Tech Radar, the company only tackled those drives where recovering data proved a straightforward task. (Source: techradar.com)

This involved buying 100 hard drives, all of which were traditional models with moving parts rather than solid state drives. The company says that 35 of the drives had easily recovered "deleted" files. Of the rest, 30 were damaged enough that they'd have required additional steps.

One In Three Secure

A further 34 were classed as sanitized. That means either they had no data, or that the drives had been overwritten with random, meaningless data. The Department of Defense recommends doing this three times to get an acceptable level security. Just one of the hundred drives had been encrypted before being sold.

Among the 35 drives with readily recoverable data, one stood out with 3.1 million recovered files. The rest had a combined 2.6 million files, meaning an average of more than 75,000.

Unfortunately this is far from a new problem. News reports dating back at least 18 years include similar experiments with similar results. One high profile case in 2009 involved a drive bought on eBay that turned out to have sensitive details of US air defense systems. (Source: dailymail.co.uk)

Physical Destruction Safest

Secure Data Recovery's Jake Reznik noted that the most secure way to avoid the problem is to physically destroy a drive, for example by shredding, drilling or disintegrating the drive's platter, the spinning part that physically holds the data. For safety reasons this is usually best done by professional specialists - but if you plan to resell or re-use the drive, this is obviously not the best choice.

Instead Reznik suggests using multiple rewrites of the entire drive with random data, then testing to make sure none of the original data is recoverable.

What's Your Opinion?

Have you ever sold or disposed of a used hard drive? If so, how did you secure it? Are you surprised by the breakdown of the 100 drives in this experiment?