{"id":6403,"date":"2017-01-28T17:10:34","date_gmt":"2017-01-28T17:10:34","guid":{"rendered":"https:\/\/stevepedwards.today\/DebianAdmin\/?p=6403"},"modified":"2023-10-28T23:31:21","modified_gmt":"2023-10-28T22:31:21","slug":"personal-data-awareness-for-brokenstolen-pcs-the-data-people-give-away-use-shred","status":"publish","type":"post","link":"https:\/\/stevepedwards.today\/DebianAdmin\/personal-data-awareness-for-brokenstolen-pcs-the-data-people-give-away-use-shred\/","title":{"rendered":"Personal Data Awareness for Broken\/Stolen PCs &#8211; The Data People Give Away! Use Shred\/Other App"},"content":{"rendered":"<div class=\"pvc_clear\"><\/div>\n<p id=\"pvc_stats_6403\" class=\"pvc_stats all  \" data-element-id=\"6403\" style=\"\"><i class=\"pvc-stats-icon medium\" aria-hidden=\"true\"><svg aria-hidden=\"true\" focusable=\"false\" data-prefix=\"far\" data-icon=\"chart-bar\" role=\"img\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 512 512\" class=\"svg-inline--fa fa-chart-bar fa-w-16 fa-2x\"><path fill=\"currentColor\" d=\"M396.8 352h22.4c6.4 0 12.8-6.4 12.8-12.8V108.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v230.4c0 6.4 6.4 12.8 12.8 12.8zm-192 0h22.4c6.4 0 12.8-6.4 12.8-12.8V140.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v198.4c0 6.4 6.4 12.8 12.8 12.8zm96 0h22.4c6.4 0 12.8-6.4 12.8-12.8V204.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v134.4c0 6.4 6.4 12.8 12.8 12.8zM496 400H48V80c0-8.84-7.16-16-16-16H16C7.16 64 0 71.16 0 80v336c0 17.67 14.33 32 32 32h464c8.84 0 16-7.16 16-16v-16c0-8.84-7.16-16-16-16zm-387.2-48h22.4c6.4 0 12.8-6.4 12.8-12.8v-70.4c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v70.4c0 6.4 6.4 12.8 12.8 12.8z\" class=\"\"><\/path><\/svg><\/i> <img loading=\"lazy\" decoding=\"async\" width=\"16\" height=\"16\" alt=\"Loading\" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/plugins\/page-views-count\/ajax-loader-2x.gif\" border=0 \/><\/p>\n<div class=\"pvc_clear\"><\/div>\n<p>I have been tinkering with PCs since my first Atari ST1040 in 1988, then a Win95 PC from\u00a01996 on, and have come into possession of many \"broken\" PCs and parts since, but it still amazes me that you can get old hard disks in boot sales etc. that have masses of personal data of the prior owners, perfectly intact - without even digging deeper or needing to use data recovery tools.<\/p>\n<p>Unbelievable...! So many people are still data unaware past 2010 - in this case.<\/p>\n<p>Intact data is mostly photos - family, friends, holidays etc. - with the occasional \"personal\" video, but often on Windows drives, there are also Contacts files - personal\/business email addresses etc. or even business documents.<\/p>\n<p>I even bought a boot sale camcorder once that had a tape inside with new baby videos on it...<\/p>\n<p>There is the potential for\u00a0a serious IT nerd\/criminal possibly recovering passwords or details to bank accounts or social media etc. which should be enough to make people think very carefully about selling or disposing of an old PC without being sure the data is fully deleted - but they often don't!<\/p>\n<p>Today I bought a WD 250GB SATA from a market stall, put it in my Linux box to check it's functionality with Disks (<span style=\"color: #0000ff;\">sudo gnome-disks <span style=\"color: #ffffff;\">if\u00a0you are<\/span>\u00a0ssh -X <span style=\"color: #ffffff;\">remotely<\/span><\/span><span style=\"color: #ffffff;\">):<\/span><\/p>\n<p><a href=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/gnomedisks.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-6404\" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/gnomedisks.png\" alt=\"\" width=\"802\" height=\"743\" \/><\/a><\/p>\n<p>to check age, history, SMART tests and benchmark etc:<\/p>\n<p><a href=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/bench250GB.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-6405\" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/bench250GB.png\" alt=\"\" width=\"642\" height=\"683\" \/><\/a><\/p>\n<p><a href=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/SMART250GB.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-6406\" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/SMART250GB.png\" alt=\"\" width=\"954\" height=\"609\" \/><\/a><\/p>\n<p>This is a perfectly good, bootable Windows 7 Home drive that mounts in Mint fine - complete with about 50GB of family photos and other user data!! Videos, MP3s, phone info, email addresses...<\/p>\n<p>What's on it?<\/p>\n<p>Amongst other things, a full $RecycleBin and User account data:<\/p>\n<p><a href=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/Users.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-6408\" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/Users-1024x576.png\" alt=\"\" width=\"590\" height=\"332\" \/><\/a><\/p>\n<p>In one account there is 46GB of Photos!<\/p>\n<p><a href=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/46GB.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6409\" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/46GB.png\" alt=\"\" width=\"714\" height=\"687\" \/><\/a><\/p>\n<p>There are mp3s (thanks for the 2 x Prince CDs to add to my collection! I'll delete the rest thanks..)<\/p>\n<p><a href=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/music.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-6410\" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/music-1024x711.png\" alt=\"\" width=\"590\" height=\"410\" \/><\/a><\/p>\n<p>Because there is so much family data, with 50Gb of photos over a 2010-2013 period, I will contact the owner - a local driving instructor from pic info - that I found\u00a0the website and number for easily on google.<\/p>\n<p>It could be that they have not backed up the data before the PC was disposed of, so lost the lot, if they didn't bother thinking about the data given away - they may not be very tech savvy. I doubt that though, as they have decent phones and know how to get the pics off, so they SHOULD have backed it all up, but..<\/p>\n<p>If nothing else, it's to let them know about ensuring correct data destruction in future, and if they don't have the pics, I'm sure they will be very pleased.\u00a0It's a huge collection to lose - lots of their kids pics at key events etc.<\/p>\n<p>There are recoverable jpgs in the Bin:<\/p>\n<p><a href=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/binjpg.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-6417 \" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/binjpg-240x300.png\" width=\"777\" height=\"971\" \/><\/a><\/p>\n<p>It won't hurt to run a CAV virus scan on it either while it's in the Mint PC - could show the reason why the owners dumped it as a non-runner? It came up clean - not that one anti-virus program is definitive by ANY means...<\/p>\n<p>So, why not try and boot it in my HP tower...? Windows should not allow this if the hardware is markedly different from that it was originally installed on but...<\/p>\n<p>After about 10 mins of self-repair it declared itself non-recoverable - then promptly restarted up to the log in screen with 4 accounts to choose from!<\/p>\n<p>Now to reboot to the linux based NTPass CD to reset the sydadmin password as explained in the prior Post:<\/p>\n<p>https:\/\/stevepedwards.today\/DebianAdmin\/locked-out-of-win-nt-offline-reg-editor\/<\/p>\n<p><iframe loading=\"lazy\" title=\"How to Reset Forgotten Windows Password with Free Linux CD\" width=\"1778\" height=\"1000\" src=\"https:\/\/www.youtube.com\/embed\/Dkks4iuPqNQ?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe><\/p>\n<p>Once into an Admin account by setting a blank password with NTPass, I reset passwords on all others, then recovered everything for each user from their Recycle Bin...or you could have kept those passwords intact with a view to cracking them for other possible uses later...lots of options at this point for potential malicious behaviour for those so inclined...a question of finding whatever you can find...<\/p>\n<p>A hacker\/criminal may have had a field day with this drive - who knows if there are hashed bank account passwords to be cracked here or even plain text memory aids that could relate to accounts?<\/p>\n<p>I already know about the pictures etc. but a look in Programs gives info on user services preference, and possible mail accounts, or documents that the C: drive could be searched for by extension such as .pdf; docx; .txt etc..Office 2010 is installed for a start so Word docs probably used:<\/p>\n<p><a href=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/progs.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-6424\" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/uploads\/2017\/01\/progs-1024x576.png\" alt=\"\" width=\"590\" height=\"332\" \/><\/a><\/p>\n<p>With more complex hacking tools, registry\/password hashes could be found and cracked leading to account access for all sorts of services - it's frightening that people can leave themselves so vulnerable in so many ways just by NOT retaining or correctly wiping\/destroying their hard drives when they move a machine on.<\/p>\n<p>OK, it could have been stolen..? There's the strong argument for us all using encryption on our hard drives, but even I don't, so who else will, except the very IT literate\/criminal\/paranoid\/ or those required to for some job reason like forces\/gov\/police etc?<\/p>\n<p>There is a whole psychological profiling side to this too, that is a really scary prospect for this falling into the wrong hands. The photos tell a lot about this family - standard of living\/probable income\/social groups\/hobbies\/vehicle ownership etc.<\/p>\n<p>One decent quality \"selfie\" may be enough lead to identity theft\/passport cloning.<\/p>\n<p>Scary isn't it?! Well, it should be...<\/p>\n<p><strong>Brief Summary of Personal Data and Info Found<\/strong><\/p>\n<p>\"personal\" videos<\/p>\n<p>family photos 2010-2015<\/p>\n<p>first and family names and children's schools from pics<\/p>\n<p>job and website of family member<\/p>\n<p>Probable Devices\/software accounts use: HTC, Sony, Apple\/iPod\/iTunes, Skype, Win Live Mail, Google<\/p>\n<p>I wonder what the reaction will be when I contact them? I have emailed and am awaiting a response.<\/p>\n<p>With luck they will have backups of it all and I can just delete it and forget it.<\/p>\n<p>If not, I'll make arrangements to send it on a 64GB pen drive in the post to their address.<\/p>\n<p>BE CAREFUL WITH YOUR DATA!!<\/p>\n<p>If data requires reasonable levels of secure deletion read the man page for Linux shred:<\/p>\n<p><span style=\"color: #0000ff;\">info coreutils 'shred invocation'<\/span><\/p>\n<p><span style=\"color: #0000ff;\">man shred<\/span><\/p>\n<p><span style=\"color: #ff0000;\">shred [OPTION]... FILE[...]<\/span><\/p>\n<p><span style=\"color: #ff0000;\">NAME<\/span><br \/>\n<span style=\"color: #ff0000;\"> shred - overwrite a file to hide its contents, and optionally delete it<\/span><\/p>\n<p><span style=\"color: #ff0000;\">SYNOPSIS<\/span><br \/>\n<span style=\"color: #ff0000;\"> shred [OPTION]... FILE...<\/span><\/p>\n<p><span style=\"color: #ff0000;\">DESCRIPTION<\/span><br \/>\n<span style=\"color: #ff0000;\"> Overwrite the specified FILE(s) repeatedly, in order to make it harder<\/span><br \/>\n<span style=\"color: #ff0000;\"> for even very expensive hardware probing to recover the data.<\/span><\/p>\n<p><strong><span style=\"color: #ff0000;\">CAUTION: Note that shred relies on a very important assumption: that<\/span><\/strong><br \/>\n<strong><span style=\"color: #ff0000;\"> the file system overwrites data in place. This is the traditional way<\/span><\/strong><br \/>\n<strong><span style=\"color: #ff0000;\"> to do things, but many modern file system designs do not satisfy this<\/span><\/strong><br \/>\n<strong><span style=\"color: #ff0000;\"> assumption. The following are examples of file systems on which shred<\/span><\/strong><br \/>\n<strong><span style=\"color: #ff0000;\"> is not effective, or is not guaranteed to be effective in all file sys<\/span><\/strong><br \/>\n<strong><span style=\"color: #ff0000;\"> tem modes:<\/span><\/strong><\/p>\n<p><em><span style=\"color: #ff0000;\">This uses many overwrite passes, with the data patterns chosen to<\/span><\/em><br \/>\n<em><span style=\"color: #ff0000;\">maximize the damage they do to the old data.<\/span><\/em><\/p>\n<p>For example to delete a file contained in a folder:<\/p>\n<p><span style=\"color: #0000ff;\">sudo shred -v --remove Pictures\/SamData\/Thumbs.db<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/Thumbs.db: pass 1\/3 (random)...<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/Thumbs.db: pass 2\/3 (random)...<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/Thumbs.db: pass 3\/3 (random)...<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/Thumbs.db: removing<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/Thumbs.db: renamed to Pictures\/SamData\/000000000<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/000000000: renamed to Pictures\/SamData\/00000000<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/00000000: renamed to Pictures\/SamData\/0000000<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/0000000: renamed to Pictures\/SamData\/000000<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/000000: renamed to Pictures\/SamData\/00000<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/00000: renamed to Pictures\/SamData\/0000<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/0000: renamed to Pictures\/SamData\/000<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/000: renamed to Pictures\/SamData\/00<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/00: renamed to Pictures\/SamData\/0<\/span><br \/>\n<span style=\"color: #ff0000;\">shred: Pictures\/SamData\/Thumbs.db: removed<\/span><\/p>\n<p>Similarly, to erase all data on a selected partition of your hard<br \/>\ndisk, you could give a command like this:<\/p>\n<p><span style=\"color: #0000ff;\">shred --verbose \/dev\/sda5<\/span><\/p>\n<p>For recovery options when your Windows PC fails to boot, you need to have pre-prepared recovery USB or DVD media from your Windows PC. DO IT NOW if you have not done\u00a0this!!<\/p>\n<p>If these above owners of this drive had done this they likely would have been able to restore this PC themselves and not ended up in this situation.<\/p>\n<p>https:\/\/www.howtogeek.com\/131907\/how-to-create-and-use-a-recovery-drive-or-system-repair-disc-in-windows-8\/<\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"pvc_clear\"><\/div>\n<p id=\"pvc_stats_6403\" class=\"pvc_stats all  \" data-element-id=\"6403\" style=\"\"><i class=\"pvc-stats-icon medium\" aria-hidden=\"true\"><svg aria-hidden=\"true\" focusable=\"false\" data-prefix=\"far\" data-icon=\"chart-bar\" role=\"img\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 512 512\" class=\"svg-inline--fa fa-chart-bar fa-w-16 fa-2x\"><path fill=\"currentColor\" d=\"M396.8 352h22.4c6.4 0 12.8-6.4 12.8-12.8V108.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v230.4c0 6.4 6.4 12.8 12.8 12.8zm-192 0h22.4c6.4 0 12.8-6.4 12.8-12.8V140.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v198.4c0 6.4 6.4 12.8 12.8 12.8zm96 0h22.4c6.4 0 12.8-6.4 12.8-12.8V204.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v134.4c0 6.4 6.4 12.8 12.8 12.8zM496 400H48V80c0-8.84-7.16-16-16-16H16C7.16 64 0 71.16 0 80v336c0 17.67 14.33 32 32 32h464c8.84 0 16-7.16 16-16v-16c0-8.84-7.16-16-16-16zm-387.2-48h22.4c6.4 0 12.8-6.4 12.8-12.8v-70.4c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v70.4c0 6.4 6.4 12.8 12.8 12.8z\" class=\"\"><\/path><\/svg><\/i> <img loading=\"lazy\" decoding=\"async\" width=\"16\" height=\"16\" alt=\"Loading\" src=\"https:\/\/stevepedwards.today\/DebianAdmin\/wp-content\/plugins\/page-views-count\/ajax-loader-2x.gif\" border=0 \/><\/p>\n<div class=\"pvc_clear\"><\/div>\n<p>I have been tinkering with PCs since my first Atari ST1040 in 1988, then a Win95 PC from\u00a01996 on, and have come into possession of many \"broken\" PCs and parts since, but it still amazes me that you can get old hard disks in boot sales etc. that have masses of personal data of the <a href=\"https:\/\/stevepedwards.today\/DebianAdmin\/personal-data-awareness-for-brokenstolen-pcs-the-data-people-give-away-use-shred\/\" class=\"more-link\">...<span class=\"screen-reader-text\">\u00a0 Personal Data Awareness for Broken\/Stolen PCs &#8211; The Data People Give Away! Use Shred\/Other App<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-6403","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"a3_pvc":{"activated":true,"total_views":1,"today_views":0},"_links":{"self":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/6403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/comments?post=6403"}],"version-history":[{"count":1,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/6403\/revisions"}],"predecessor-version":[{"id":10074,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/6403\/revisions\/10074"}],"wp:attachment":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/media?parent=6403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/categories?post=6403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/tags?post=6403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}