If you believe deleting all your programs and files or running your original system restore software will erase everything from your hard drive, you may be an identity thief’s best friend. Your computer may be safely locked in your office or home but sooner or later you’ll replace it and will either donate your current computer or dispose of it (hopefully at a reputable recycling facility). Your hard drive may then become easy prey for identity thieves, the fastest growing body of criminals in the United States.
In his recent presentation on the “Role of Computer Forensics in HR” for Montgomery County SHRM, Paul Brown (CEO of CyberEvidence), focused on how and why employers should remove and store the hard drives of departing employees’ computers, so that these hard drives could be accessed later in the event that the ex-employee was suspected of having stolen and/or shared any of the organization’s proprietary information. However, during the question and answer period, I asked Brown about the best method for completely deleting the contents of a hard drive when an organization or an individual is donating or disposing of (through a proper recycling center), an old computer. I has assumed that running the original system restore software would completely erase the hard drive. Mr. Brown informed me that it would not. Apparently computer forensic experts and their criminal counterparts can unearth hidden backup or shadow files even after you restored your hard drive to its original, fresh out of the box configuration.
He then went on to advise me that the one sure way to delete the contents of a hard drive was to remove the hard drive from the computer and smash it into pieces with a hammer. Right. Like I know exactly where the hard drive is located, what it looks like, and how to remove it.
The next best alternative, he said, was to download a hard drive wiping software off the web and use it to wipe your hard drive clean (the process may take several hours) before donating the computer or disposing of it at a recycling center. There are a number of freeware and shareware programs available at http://www.tucows.com complete with user reviews, if you’re interested.
If your company maintains sensitive data on its computer (such as employees’ birth dates and social security numbers), you should have a policy mandating the removal and high security storage of hard drives or the physical destruction or the wiping of the hard drives in any computers that are to be disposed of. Likewise, if you or other HR staff have such information stored on your personal laptops or PDA’s you should destroy or wipe the hard drives before disposing of them.
For detailed instructions on destroying your hard drive, check out Hard Drive Destruction Crucial at the BBC Online.