{"id":1391,"date":"2024-10-06T14:52:56","date_gmt":"2024-10-06T20:52:56","guid":{"rendered":"https:\/\/fallingstuff.net\/blog\/?p=1391"},"modified":"2025-10-24T16:18:04","modified_gmt":"2025-10-24T22:18:04","slug":"tales-of-ebay-part-5","status":"publish","type":"post","link":"https:\/\/fallingworks.com\/blog\/2024\/10\/06\/tales-of-ebay-part-5\/","title":{"rendered":"Tales of eBay &#8211; Part 5"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Keeping going from <a href=\"https:\/\/digitalstuffy.com\/officehours\/2022\/06\/12\/tales-of-ebay---part-4\/(opens in a new tab)\">Part 4<\/a> yesterday and the next drive off the stack. Things start getting spicy here. Let me get the pictures and I will explain more &#8230; <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"890\" height=\"302\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-21_08_45-Local-Disk-E_.png\" alt=\"\" class=\"wp-image-2730\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-21_08_45-Local-Disk-E_.png 890w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-21_08_45-Local-Disk-E_-300x102.png 300w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-21_08_45-Local-Disk-E_-768x261.png 768w\" sizes=\"auto, (max-width: 890px) 100vw, 890px\" \/><figcaption class=\"wp-element-caption\">The drive auto ran when it was connected to my laptop and shows very empty<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"557\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-21_10_03-1024x557-1.png\" alt=\"\" class=\"wp-image-2731\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-21_10_03-1024x557-1.png 1024w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-21_10_03-1024x557-1-300x163.png 300w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-21_10_03-1024x557-1-768x418.png 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">But in past looks with the Hex Editor, there is data <\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"787\" height=\"950\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-06-12-140051.png\" alt=\"\" class=\"wp-image-2732\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-06-12-140051.png 787w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-06-12-140051-249x300.png 249w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-06-12-140051-768x927.png 768w\" sizes=\"auto, (max-width: 787px) 100vw, 787px\" \/><figcaption class=\"wp-element-caption\">NTFS Recover works its magic and brings back a whole lot of stuff &#8230;<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"796\" height=\"398\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-06-12-140029.png\" alt=\"\" class=\"wp-image-2733\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-06-12-140029.png 796w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-06-12-140029-300x150.png 300w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-06-12-140029-768x384.png 768w\" sizes=\"auto, (max-width: 796px) 100vw, 796px\" \/><figcaption class=\"wp-element-caption\">&#8230; in a only a few drive structures<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">At this point I stop with the images because from this point, things go down hill very rapidly. This was another drive that I had looked at later in the adventure and became quickly horrified by what I turned up. There was just about no OPSEC (Operation Security, aka &#8220;Clean up your stuff&#8221;) before this drive was just formatted and thrown up for sale. The quick list of content recovered included &#8230; <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Adult Images \/ Videos <\/li>\n\n\n\n<li>Family pictures <\/li>\n\n\n\n<li>Vacation and Holiday event pictures <\/li>\n\n\n\n<li>Legal documents from family court <\/li>\n\n\n\n<li>Divorce papers and &#8220;Sanitized&#8221; divorce papers (the names were changed to protect &#8230; someone) <\/li>\n\n\n\n<li>Tax documents <\/li>\n\n\n\n<li>Cisco test prep materials <\/li>\n\n\n\n<li>Hardware Manuals<\/li>\n\n\n\n<li>Outlook email archives (some were fairly large, over 1+GB)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Honestly, this was not a good discovery and I just kept repeating &#8220;Why am I able to see ANY OF this ?!&#8221; The part that bothered me the most was that the name I referred to yesterday was the same name that was turning up in these drives. Somehow both these drives are connected to the same person.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">5 drives down, 2 to go. This experiment is rough. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Keeping going from Part 4 yesterday and the next drive off the stack. Things start getting spicy here. Let me get the pictures and I will explain more &#8230; At this point I stop with the images because from this point, things go down hill very rapidly. This was another drive that I had looked &hellip; <a href=\"https:\/\/fallingworks.com\/blog\/2024\/10\/06\/tales-of-ebay-part-5\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Tales of eBay &#8211; Part 5<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_bluesky_dont_syndicate":"","_bluesky_syndication_accounts":"","_bluesky_syndication_text":"","footnotes":"","_share_on_mastodon":"0"},"categories":[48,45],"tags":[],"class_list":["post-1391","post","type-post","status-publish","format-standard","hentry","category-data-recovery","category-privacy"],"share_on_mastodon":{"url":"","error":""},"_links":{"self":[{"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/posts\/1391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/comments?post=1391"}],"version-history":[{"count":2,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/posts\/1391\/revisions"}],"predecessor-version":[{"id":2734,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/posts\/1391\/revisions\/2734"}],"wp:attachment":[{"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/media?parent=1391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/categories?post=1391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/tags?post=1391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}