Sensitive data found on eBay hard drives

Forty percent of the hard drives purchased by a computer forensics firm from eBay contained personal, private information, ranging from corporate financial data to the web surfing downloads of a man with a foot fetish.

Kessler International conducted the survey over a six-month period, buying up disk drives from the United States and Canada ranging in size from 40GB to 300GB. The firm, which completed its survey about two weeks ago, bought a total of 100 relatively modern drives, the vast majority of them serial ATA.

"With size of the sample, I guess we were surprised with the percentage of disks that we found data on," said Michael Kessler, CEO of Kessler International. "We expected most of the drives to be wiped - to find one or two disks with data. But 40 drives out of 100 is a lot."

While Kessler's engineers had to use special forensics software to retrieve data from some of the hard drives, others contained sensitive data in the clear, having never been overwritten or erased. The data included personal documents, financial information, emails, DNS server information and photographs.

"The average person who knows anything about computers could plug in these disks and just go surfing," Kessler said. "I know they found a guy's foot fetish on one disk. He'd been downloading loads and loads of stuff on feet. With what we got on that disk - his name, address and all of his contacts - it would have been extremely embarrassing if we were somebody who wanted to blackmail him."

Kessler said his company specifically avoided buying drives whose sellers indicated they'd been erased.

Kessler International broke down the kind of data it retrieved this way: Personal and confidential documents, including financial information, (36 percent); emails, (21 percent); photos, (13 percent); corporate documents, (11 percent); web browsing histories, (11 percent); DNS server information, (4 percent); Miscellaneous data, (4 percent).

"We were more concerned with searching for people's identification, which is what we found, but we were surprised by all the corporate spreadsheets and business finance records we found," Kessler said.

The forensics firm even found one company's "secret" French fries recipe, Kessler said.

In recent years, hard drives have shown up on eBay that contain all kinds of sensitive data. In April 2006, Idaho Power Co. learned that drives it thought had been recycled had actually been sold on eBay with data still intact . The Boise, Idaho-based utility had used the drives in servers; when bought on eBay, they still contained proprietary corporate information such as memos, customer correspondence and confidential employee information.
And in 2007, a supposedly new hard drive purchased on eBay was found to contain information from the Arkansas Democratic Party.