Old hard drives, what’s hiding in your cupboard?

Still down here in Australia, and to be perfectly honest, utterly amazed that the whole OP-EZY site is still running, even though it’s purely administrating itself at the moment! (Applying updates, maintaining DDNS, etc.) Nothing seems to have packed up whilst I’ve been away. Which brings me nicely onto todays subject: Old hard drives!

This isn’t my first trip down under. In March, 2005, I came here. Back in the days before Facebook, people used to use Instant Messaging applications a lot. MSN (MicroSoft Network) Messenger, was the system most people I knew used. So whilst I was down under, I built myself a nice, low budget, PC for no other reason than to keep in touch with my mates back home.

This machine was built on the cheap. I bought a motherboard and an AMD Sempron Processor from the Computer Swap Meet, and paired them up with an empty ATX case with PSU, which was already kicking about in the house, along with a DVD-ROM drive, a floppy drive, and a Hard drive. The hard drive in question, was a 17.2 Gigabyte, Seagate Medalist 17242. (Model Number ST317242A).

I installed Fedora Core 3, a GNU/Linux based operating system, as, it was free, and came with Gaim (Later renamed Pidgin), which allowed me to access MSN.

Disaster struck after a few days, when the Hard Drive packed in. Meaning, I had to buy another hard drive at the Swap Meet that next Sunday.

Fast Forward Five Years…

So, I was given a task whilst I was here, to test a bunch of hard drives that were sitting on a shelf in my uncle’s office. I tried each one in turn, most of them where on their way out. Then I picked up a familiar looking Seagate. When I powered it up, it made an awful noise, and I thought to myself “hey, I recognise that sound, I’m sure that’s the sound that drive I had made 5 years ago!”

Of course, this drive was totally unreadable, I was unable to mount it on Linux, and Windows wouldn’t talk to it either. It couldn’t even be formatted! But curiosity got the better of me, and I downloaded a nice little program called “DiskExplorer” by Run Time Software, and was able to access the drive’s sectors at a Low Level stage. This is a similar method used in forensics labs.

The screenshot below shows the contents of the drive at Sector 9,926,710. Clearly showing some HTML, this HTML is actually a log Gaim (Pidgin) made of a conversation I had with someone back in 2005!

Browsing the hard drive, one byte at a time! (Each Hexadecimal value, printed on the left, is equal to one byte, it is converted to a readable ASCII code on the right)

I was able to copy this back into an HTML file, and load it back into my current selection of Pidgin logs:

The log, after being copied back to Pidgin, over 5 and a half years after it was destroyed

Now for the point of this story

As most people know, when you delete something from a hard drive, it’s not actually deleted, but just the reference to the file is removed, in the case above, the system forgets there’s something stored at sector 9,926,710, and if something comes along and want to write over what’s there, the system will let it. Of course, until that time comes, the original data is still there, and there is plenty of software out there that can recover this data.

But what if your hard drive is unreadable? Well, once again, as you saw by my example above, I was able to recover data off a drive that wasn’t readable by either Windows or Linux. The program itself is even free to use for 30 days meaning anyone has access to this kind of software!

Studies show that over a third of second hand hard drives are sold with personal information still on them, even some top secret information! So what can be done? The easiest thing anyone can do is, when they’re finished with a hard drive, they should destroy it, or keep it in a safe place.

By “destroy”, I mean, physically making sure the platters inside the drive are totally unreadable. That is the only sure way you know your personal data can’t fall into the wrong hands!

Cheers