New Study Finds Ghost Data Haunts Devices

As the leaves change colors, the air becomes crisp and pumpkin-spiced everything fills the shelves, we think of little (and big) kids going door to door for candy, apple picking, and all those Halloween ghost stories. Not the stories that end with “BOO!” But the stories that make your hair stand on end and your skin crawl. One such horror story has been revealed in a recent study conducted by Blancco Technology Group and Kroll Ontrack.

Ghost Data Haunts Second-hand Equipment

In an examination of 122 pieces of second-hand equipment—mobile devices, hard drives and solid state drives purchased online from Amazon, eBay, and Gazelle.com—48%of the hard drives and solid state drives contained residual data, while thousands of leftover emails, call logs, texts/SMS/IMs, photos, and videos were retrieved from 35% of the mobile devices. This study highlights the prevalence of ghost data on second-hand devices and technologies.

The study further found that 57% of used mobile devices and 75% of used hard drives had unsuccessful deletion attempts previously made before their sale. In addition, the survey also found that only basic delete functions were performed prior to the resale on 11% of the devices, and that the often-used “quick-formatting” functions are unreliable, having been performed on 61% of the drives with data still present. These ghastly numbers are even more disconcerting when you consider the growing second-hand marketplace for used devices—even more so when you consider the increasing prevalence of BYOD policies.

Residual Data Enough to Identify Original Users

Perhaps most startling, however, was that the residual data left on two of the second-hand mobile devices were significant enough to discern the original users’ identities. Whether it is a person’s emails containing his or her contact information or media files involving a company’s intellectual property, data haunting old devices can have serious consequences.

Together, all the findings in this joint study serve as a powerful warning about the importance of using effective data erasure methods and the need to mitigate security risks that may occur when done improperly or incompletely, and has sparked further conversation over at Legaltech News on the prevention of improperly deleted data. At the very least, it should raise some hairs—or some eyebrows—as to the amount of data haunting our old devices, long after it should have been dead.