Zombie Hard Disks: Data from the living dead

Andrew Blyth, Iain Sutherland, A. Jones, Gareth Davies

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

There have been a number of studies conducted in relation to data remaining on disks purchased on the second hand market. A large number of these studies have indicated that a proportion of these disks contain a degree of residual data placed on the drive by the original owners. The Security Research Centre at BT has sponsored a residual data study over the last five years examining disks sourced around the globe, in the UK, USA, Germany France and Australia. In 2008 as part of a 5 year study, Glamorgan University in conjunction with Edith Cowan University in Australia, Longwood University in Virginia USA and the BT Security Research Centre completed the fourth annual disk study aimed at assessing the volume and nature of information that remains on computer hard disks offered for sale on the second hand market. One of the main findings of the study was the high proportion of disks that are sold in a non-functioning state. As in both previous and following years a percentage of the hard disks examined in the 2008 study failed the imaging process and were marked as faulty. This paper describes further analysis of a number of these faulty drives from the UK sample set of the 2008 study. This paper details the analysis of non-functioning disks supplied to the University of Glamorgan to determine the ease with which data can be recovered from these drives using specialist recovery tools. It discusses implications for both computer forensics and information security practices and procedures.
Original languageEnglish
Title of host publicationProceedings of the 8th Australian Digital Forensics Conference, Edith Cowan University, Perth Western Australia, November 30th 2010
DOIs
Publication statusE-pub ahead of print - 28 Nov 2010
Event 8th Australian Digital Forensics Conference - Edith Cowan University
Duration: 28 Nov 201028 Nov 2010

Conference

Conference 8th Australian Digital Forensics Conference
Period28/11/1028/11/10

Keywords

  • forensics
  • disk disposal
  • data recovery

Fingerprint

Dive into the research topics of 'Zombie Hard Disks: Data from the living dead'. Together they form a unique fingerprint.

Cite this