Analysis of Data Recovered from Computer Disks released for Resale by Organisations

摘要

Public and private sector organisations frequently use computer storage media to hold information relating to their business or services, their employees and customers. Private individuals make use of personal computers in their home and frequently store personal information relating to both themselves and their families. This raises questions about privacy and the need to dispose of data thoroughly and securely. Most organisations and individuals are probably blissfully unaware of what actually happens to the storage media in the form of the hard disk drives that are fitted into the computers, after they have disposed of old equipment. In this paper we describe research in which a number of hard disks were taken from computers after they had been released far resale. The disks that were used for the experiment were supplied blind by a third party. The research that was undertaken involved an analysis of the disks in order to determine exactly what information (if any) remained on them in a form that could be easily recovered using commonly available tools and techniques. From this analysis, a number of disks could be traced to specific organisations, including a number of academic institutes and a number of both large and small businesses. In addition to these, a number of computers that appear to have been used in the home environment were also identified. Typically, the type of information that was recovered related to the operating system, documents containing business related and personal information including sensitive business plans, electronic mail messages, the web history, and personal data held by businesses. The results indicate that the careless disposal of computer storage media in the UK is a significant problem. Very few of the disks investigated had undergone a thorough or efficient cleansing process. There are obvious implications for privacy, for data protection issues and corporate governance. The level of information that could be recovered from the majority of the disks tested would have proved useful far corporate espionage, identity theft, and background intelligence for computer hackers.