Data Remanence in New Zealand D. Roberts A thesis submitted for the degree of Doctor of Philosophy at the University of Otago, Dunedin, New Zealand 7 March 2013 Abstract International research has shown that individuals and companies in other countries do not always fully remove the data from their computer data storage devices before disposing of them. Typically this means when people are disposing of their computer hard drives there is a wealth of personal or corporate information that can be exploited to commit such crimes as identity theft, fraud, stalking and blackmail. A further literature review showed that no such “data remanence” research for hard drives (or any other data storage devices such as mobile phones, USB thumb drives and the like) had been conducted in New Zealand. The methodologies for all relevant hard drive data remanence experiments were compared and then used to design the most appropriate methodology for this research. 100 second hand hard drives were then sourced nationally across New Zealand for the experiments of this research to determine the baseline of data remanence for hard drives in New Zealand. The results of the experiments were then compared with international results to determine how New Zealand compares and what if any further actions (such as education) should be taken. ii Acknowledgements Writing the acknowledgements is often one of the hardest parts of a thesis. There are simply too many people to thank and no really good scheme to organise those acknowledgements. If I have missed you out, please accept my apologies. I need to thank: My parents and grandparents who were great role models and fostered a love of learning that eventually led to this thesis. My primary supervisor Dr Wolfe for his years of support, guidance, wisdom and sense of humour. The Infosci office staff, especially Gail Mercer and Stephen Hall-Jones. The Infosci Tech Support Group for always having the right equipment or the right solution to the thorny hardware problems encountered in this thesis. My proofreaders Dr Melanie Middlemiss and Miss Amberleigh Nicholson for their excellent eye for detail, constructive criticism and spotting the really obvious mistakes tht always creep in. Special thanks go to Dr Nigel Stanger for his feedback and thought provoking suggestions that really improved this thesis and the future work that will come from it. Special thanks also to Brian Niven of the Maths and Stats department for his excellent advice and recommendations regarding statistics in this thesis. The University of Otago for funding parts of this research. The thesis examiners and Dr Martin Purvis as the convenor for providing timely and important feedback that improved this thesis. Dr Chris Roberts* and his co-workers for recognising the importance of this topic and encouraging me to research it. There were so many friends, office mates and fellow students who offered a laugh, distractions, shenanigans or really good ideas for this thesis. Some of those people (in alphabetical order) include: G. Can, Gerald Cochlan, G. Corso, Kris Evans, Jason Glazier, A. Godek, K. Gorton, “K.H”, J. Horton, Mark Hodge and members of the various board gaming groups, T. Inley “S.D.K”, L. Lau, Simon Mooney, Brendan Murray, J. Norris, Kevan Quinn, Bobbi Smith, Clint Sparks, and Ed Stackhouse. *No relation. iii Table of Contents Abstract ...................................................................................................................................... ii Acknowledgements .................................................................................................................. iii Table of Contents ...................................................................................................................... iv List of Figures ........................................................................................................................... ix List of Tables ............................................................................................................................. x Chapter 1: Introduction .............................................................................................................. 1 1.1 Introduction ...................................................................................................................... 1 1.2 Key Definitions ................................................................................................................ 2 1.3 Research Objectives and Methodology ........................................................................... 2 1.4 Contributions.................................................................................................................... 3 1.5 Structure ........................................................................................................................... 4 Chapter 2: Background .............................................................................................................. 5 2.1 Introduction ...................................................................................................................... 5 2.2 Data Storage Devices ....................................................................................................... 5 2.2.1 Physical hardware of Hard Drives ............................................................................ 6 2.2.1.1 Electro-mechanical Drives ................................................................................. 6 2.2.1.2 Solid-State Drives .............................................................................................. 8 2.2.1.3 Hybrid Drives..................................................................................................... 8 2.2.2 Interface Types .......................................................................................................... 9 2.2.2.1 Small Computer System Interface (SCSI) ....................................................... 10 2.2.2.2 Integrated Device Electronics (IDE) aka ATA ................................................ 11 2.2.2.3 Comparison between SCSI and IDE ................................................................ 12 2.2.2.4 Serial AT Attachment (SATA) ........................................................................ 13 2.2.2.5 Universal Serial Bus (USB) ............................................................................. 14 2.2.2.6 Adapters ........................................................................................................... 15 2.2.3 Interactions between Hard Drives and Operating systems ..................................... 15 2.2.3.1 Hidden Disk Areas ........................................................................................... 15 2.2.3.2 Master Boot Record ......................................................................................... 16 2.2.3.3 Partitions .......................................................................................................... 16 2.2.4 Other data storage devices: Mobile/Smart Phones ................................................. 17 iv 2.3 Technical issues regarding Hard Drive Data Remanence .............................................. 21 2.4 Forensic Computing ....................................................................................................... 24 2.4.1 What is Forensic Computing .................................................................................. 24 2.4.2 Minimal handling of the Original ........................................................................... 24 2.4.2.1 Dead forensics .................................................................................................. 25 2.4.2.2 Live forensics ................................................................................................... 26 2.4.3 Accounting for Change ........................................................................................... 26 2.4.4 Comply with the rules of evidence ......................................................................... 28 2.4.5 Implications for this research .................................................................................. 29 2.5 Psychology of Security .................................................................................................. 29 2.5.1 Relevance to Data Remanence ................................................................................ 32 2.6 Risks arising from Data Remanence .............................................................................. 32 2.6.1 Legal Requirements: New Zealand Privacy Act ..................................................... 33 2.6.2 Espionage ................................................................................................................ 34 2.6.3 Identify Theft .......................................................................................................... 35 2.6.3.1 Financial Identity Theft.................................................................................... 35 2.6.3.2 Non Financial Identity Theft ............................................................................ 37 2.6.3.3 Criminal Record Identity Theft ........................................................................ 37 2.6.3.4 Potential Identity Theft and Data Remanence ................................................. 37 2.6.4 Blackmail ................................................................................................................ 39 2.6.5 Stalking ..................................................................................................................