After the last Tales of eBay I got to thinking, I wonder if I can find other drives that were not cleaned … Or … better put how MANY I can find. So off to eBay I went to buy more drives than I needed to answer this question, because I put bids on auctions not expecting to win .. and did. I set out on this adventure with a total of 23 drives and a goal to see IF I could recover anything from an erased drive sold on eBay. Then the scope crept a bit to include NTFS Recover and Forensics practice. Then the scope crept more to include pairing up similar drives to attempt to swap platters (in the future).
After way too long of letting tools run, I decided after a few hundred thousand files, that I had enough material to answer my original question. In retrospect, this project took way too long and got way too complicated for a casual experiment. I settled on 6 drives out of the batch and will be putting out a post on each one to make a full week of posts on this (sloppy) Adventure in Data Recovery.
I start with the drive where I remembered to snag the screenshots from the searches with NTFS Recovery before it processed the files for recovery.
My point of this exercise is not to call out SPECIFIC data but just to say that things were not removed like they should have been. However just a little bit of what did not get removed included
- Passwords
- Hardware Manuals, Training docs
- Emails
- Encrypted Zip files
So, first drive into the batch and I have already found things and am disappointed. 1 down, 5 to go. Onward tomorrow with the next drive.