Digital @ AsiaOne

Secrets that don't die when you sell your old computer

Files deleted by users before they sell their PCs can be retrieved from the hard drives by hackers using tools available on the Net; cellphones are vulnerable too.
Jeremy Au Yong

Sun, Sep 10, 2006
The Straits Times

When Eric, a 39-year-old electrician, sold his PC, he did not realise it would make him look like a regular visitor to porn websites.

Both had assumed, wrongly, that their personal data was gone forever when they deleted all the files in their computers.

The Sunday Times took both computers to tech experts at CBL Data Recovery Technologies.

It did not take them long to resurrect a large chunk of deleted information from the two systems.

The computers had earlier been bought via online ads for $220 and $100 respectively.

The two cases serve as a warning. Three-quarters of Singaporeans have at least one computer in their home and more than nine in 10 have cellphones.

The hard disk drive found within each computer will potentially contain thousands of pages of information like e-mail, bank details, address books and passwords by the time each is sold.

Those who do not take the precaution of permanently deleting this information run the risk of it falling into the wrong hands.

At the heart of the matter is a fact about disk drives of which few users are aware: Deleted data does not actually go away; you just cannot see it.

Given the right tools - dozens of which can be found cheaply on the Internet - the deleted files can be brought back to life.

On Eric's disk were documents containing primary school timetables for his son and niece, as well as their teachers' names.

There were also letters excusing them from school and physical education lessons, family photos and - embarrassingly - a number of pornographic pictures.

Louis' disk coughed up even more. Dozens of e-mail messages painted a picture of his life: He had been looking for a job in the United Arab Emirates, was working in sales, joined a multi-level marketing company, was involved in a school parent-teacher association, had complained to the Housing Board about a mosquito problem and complained to the Education Ministry about students of a school being rowdy near his home.

Also uncovered were the user-names and passwords to access his accounts at both the job agency he had been using and the company he had joined.

It is no secret that the data on hard drives can speak volumes about their owners. In many criminal cases - like the case against three racist bloggers last year - the computer is one of the first things investigators take.

What might be surprising for Eric and Louis, and many others, is that data deleted years ago could be so easily retrieved.

Said Louis: 'As home users, we are not aware that this information could be retrieved. I thought that when you delete and empty the Windows recycle bin, it is gone.'

But as CBL managing director Samuel David, 38, explained, data is not actually lost when you delete it or reformat your drive.

The potential breach was demonstrated three weeks ago by the BBC, when they purchased 17 recycled hard drives in Nigeria and had forensic experts trace their owners in the United Kingdom by looking at its deleted data.

Then last week, mobile phones joined the list of vulnerable devices. The Associated Press reported that United States tech firm Trust Digital recovered personal data from 10 second-hand cellphones they bought through the Internet.

In his Changi lab, Mr David demonstrated how quickly professional data recovery companies can resurrect deleted files.

Mr David said: 'You can get more with a lab and specialised knowledge, but an everyday hacker can just use off-the-shelf software. Anybody can do it.'

Mr Cheong Boon Leong, 40, an engineer with data recovery firm, Simplexz Data Recovery, agreed.

Both men said the safest way to destroy information is either to download a program that does what they call a 'wipe', or simply physically destroy the hard drive.

jeremyau@sph.com.sg

 

 
 
 
Copyright ©2007 Singapore Press Holdings Ltd. Co. Regn. No. 198402868E. All rights reserved.
Privacy Statement Conditions of Access Advertise