Hard drives tell all.

• Author: Swartz, Nikki
• Position: Up front: news, trends & analysis

According to Gartner Inc., about 150,000 hard drives were retired in 2002. Many ended up in the trash can, but some, no doubt, found their way back onto the market. Hard drives that contain personal information raise privacy and identity theft concerns because they can reveal a lot about their users.

On common operating systems such as Microsoft's Windows, simply deleting a file, or even emptying the trash folder, does not necessarily make the information irretrievable. Those commands generally delete a file's name from the directory, but the information itself will survive until it is overwritten by new files. Even reformatting a drive may not delete sensitive data.

That means all personal information stored on the hard drive may be up for grabs if the user gets rid of or resells that computer. Massachusetts Institute of Technology (MIT) graduate students Simson Garfinkel and Abhi Shelat recently released a study illustrating the problem. They bought 158 used hard drives at secondhand computer stores and on Ebay. Of the 129 drives that functioned, 69 still contained recoverable files and 49 contained significant personal information, including medical records and 5,000 credit card numbers. One even revealed a year's worth of transactions and account numbers from a cash machine in Illinois.

Most of the hard drives acquired by the students came from businesses that apparently had misplaced confidence in their ability to "sanitize" old drives--something that happens too often.

Last spring, Pennsylvania sold...