But, only in a roundabout way. Some intrepid reporters decided to spend $50 bidding on eBay for used computer hard drives, and see what kind of information they could glean from these magnetic devices. It turns out that they hit the jackpot, something that could have been prevented with the use of hard drive encryption software solutions like AlertBoot.
Call For Action bid on ten used hard drives to see what they could find on these digital media. The hard drives were analyzed by a computer expert, more specifically, someone working at a data recovery service in LaBelle, Florida. What he found surprised him. It surprised me as well, although I cannot say it was totally unexpected.
One of the drives that was analyzed contained data on 200 financial transactions from a wealth management company based out of New York, with a large transaction being just under $2 million. Another disk contained credit card numbers and drug prescriptions from a pharmacy. And two disks contained service calls for a large US retailer, which included customer names, addresses, and 750 credit card numbers.
When the data recovery expert was prompted if it was hard to recover the data, he replied, “It was not a complicated process for someone who knows what they're doing. It's not a complicated process for someone who doesn't know what they're doing.” [My emphasis]
Unfortunately, the italicized words in the above quote is not a typo. It is surprisingly easy to recover data from hard drives. You’ll notice that the story pointed out four hard drives out of ten purchased. That’s probably because the remaining six hard drives didn’t contain any data of value, or perhaps were completely wiped clean of data—as they should have been.
But, what should have been doesn’t always happen. Mistakes are made. Hard drives can and are resold without having their contents correctly deleted. We must take also into consideration that eBay is something of a haven for stolen goods that cannot be properly tracked. (This is true for any online auction or classifieds site.) There is a good chance that the data was recovered because the thief who unloaded the drives didn’t do (and didn’t have an incentive) to do an adequate job of deleting sensitive data, among other reasons.
It seems to me that companies are doing themselves a great disservice by not using full disk encryption, in two ways. One, by not using encryption, they are expending resources on what is essentially cleaning up their trash. Sanitizing data, while an easy process, is also a time intensive process. With today’s hard drive capacities, it would take hours upon hours to ensure that one hard drive has truly had its data deleted and not available on that disk. This is a terrible way to use your IT budget: a guy you’re paying over $20/hour to never keep his eyes off a computer that is doing nothing but writing random data to a hard drive.
Two, if you’re not using encryption, it means that you are setting yourself up for a potential data breach when your computer gets stolen or lost. Yes, there are other ways to get a data breach. But the loss of equipment is a commonplace occurrence; hackers holding your site hostage is not.
With whole disk encryption, though, you can kill two birds with one stone. A data breach becomes unlikely if disk encryption is protecting the computer’s contents. Plus, when the time comes to get rid of those disks, all you have to do is…nothing. Just give the thing a quick format if you are really worried, but that’s it. The data on that computer is protected because the original content is still encrypted.