Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Obviously this is very open-ended. But, I'm just paranoid about people going through everything on my laptop after I leave my job. Here are the things I'm planning to do:

  1. Completely wipe all browser caches/histories/passwords, etc.
  2. Delete my Skype database files and configurations so that nobody can log into my account for view my old messages.
  3. Delete the Outlook data file for my gmail account, and the archive files for my work e-mail. I realize there's nothing I can do about the e-mails on my work e-mail account that are on the mail server... unless somebody has an idea?
  4. Delete anything non-work related from the hard drive. Though, from what I understand, there are ways of restoring deleted files from a hard drive, right? Is there any way to prevent that, short of doing a DOD wipe on the entire drive?

That's about all I can think of. Does anyone have any other suggestions? Is there anything that the IT people might try to do that I'm not aware of? I'm not trying to hide anything weird or illegal; I'm just concerned about my personal privacy.

Thanks.

share|improve this question
10  
I believe there was a particular stapler-obsessed man who worked at Initech that had a pretty good solution to this problem. –  James Santiago Mar 9 '11 at 21:48

11 Answers 11

The proper answer for this question is very situational, and dependent upon the policies and procedures in place at your company. Many companies have in place methods of backing up portions of the drive meant for user data, or even the entire drive, across the corporate network. If they've performed such backups on your system, there's nothing you can do to prevent them from accessing your data.

Beyond that, if your company allows, the only things you can do to definitively prevent restoration of your data off the laptop drive, is to do a secure wipe of that data or the whole drive, degauss, or outright destroy the drive.


EDIT: While the above discusses what you might be able to do about your privacy now, there really is a larger issue at hand.

If you're really concerned about your personal privacy, don't use corporate resources for personal purposes. Most companies have included in their Acceptable Use Policy or similar documentation, a clause that specifically says you may be subject to monitoring and have no expectation of privacy when using their systems. In many jurisdictions, this means that they can do whatever they want to observe and record your activities with or without your explicit consent (generally, your consent is given implicitly upon your agreement to the AUP) and/or knowledge - causing any retroactive attempts at personal privacy to be futile and ineffective.

Case in point: At one former workplace, I heard of a user who decided to do some, let's say, "very personal" web browsing on a company laptop while he was on his home network. Apparently he was under some delusion that whatever he did with the company's hardware was none of their concern if he did it on his own Internet connection. To be safe though, I'm sure he had some good history cleaning software in place and in use. He was also technically savvy enough that he probably did some manual cleaning of his own, periodically.

What he didn't know was that the company had monitoring software installed locally and running in the background. This software would record his Internet activities at all times, and relay the logs to the corporate servers whenever the laptop was connected to the intranet. You can imagine the resulting disciplinary actions when this occurred.


TL;DR: Keep your business on your hardware, and company business on company hardware.

share|improve this answer
    
I agree. This is the correct (sane) answer out there. Wasting days cleaning up the mess programs like web browsers leave behind is not even worth it. –  Christian Mar 7 '11 at 15:27
2  
Yep - most larger companies will have your computer backed up somewhere to comply with their disaster recovery/business continuity policy. Best to assume your details will remain in their archives for a long time :-) –  Rory Alsop Mar 7 '11 at 17:11
1  
You cannot erase what you've already left behind. I keep telling the incredulous this, but no amount of erasure gets rid of the past that has passed through the network. It gets backed up somewhere for unknown retention periods (that forgotten DVD at the back of the locker) and that which passes outside the company may have a lifetime of forever. –  Fiasco Labs Jan 6 '12 at 4:02

I'll put my proper IT hat on - still just about fits - and suggest you could try asking your IT team what their process is - the answer might reassure you.

Typically, IT are going to make a "just-in-case" backup of your drive and put it on a shelf ("just-in-case" management realises a year after you've gone that you had a file on your drive that is urgently needed) and then wipe the whole thing themselves before re-imaging. We're not interested in your Skype logs, we just want to turn the hardware round as fast as possible.

InfoSec hat back on, and I have a sudden urge to update our guidelines with what to do if someone asks that question. We'd want to be very calming and reassuring, while holding them in the room long enough for HR to search their desk and IT to image their laptop and network shares.

share|improve this answer
3  
+1 for "We'd want to be very calming and reassuring, while holding them in the room" - nice –  Rory Alsop Jan 6 '12 at 10:46

Considering the amount of stuff you're mentioning, I would wipe out the drive entirely. You can run some software to fill the drive with garbage a couple of times. Better still, take the drive with you, or burn it up :)

Edit: I think swapping their drive with a new one is entirely reasonable, at a reasonable cost too. Depends on company policies, most probably.

share|improve this answer
1  
"Better still, take the drive with you, or burn it up" - assuming the company has no recourse for theft or destruction of its property...which they usually do. –  user185 Mar 7 '11 at 14:34
1  
Of course that would have to be arranged, but we're in security, not law ;) –  Christian Mar 7 '11 at 15:23
2  
Overwriting multiple times is an urban legend. See my comment to SteveS' answer. See, for example, Wikipedia (Gutmann method): "Most of the patterns in the Gutmann method were designed for older MFM/RLL encoded disks. Relatively modern drives no longer use these older encoding techniques, making many of the patterns specified by Gutmann superfluous." –  0xC0000022L Mar 8 '11 at 3:34

Wipe the disk with something government approved. Given that most companies have policies around using work computers for personal stuff, it seems like they would be fairly lax around receiving a wiped drive.

Then again, you are leaving anyway, so it wouldn't really matter.

share|improve this answer
4  
Actually this is more an urban legend than based on facts. Overwriting with zeros is enough. The probability values to restore data are for single bits, combine that into a byte or the size of a cluster and the chance to recover is sooooo minimalistic that it's not worth mentioning. The original methods for multiple overwriting were developed for tape and floppy drives and are no longer suitable. –  0xC0000022L Mar 8 '11 at 3:32
    
@0xC0000022L Sounds reasonable, but is there a proof on the Internet? –  Sarge Borsch Jul 17 at 11:29
    
@SargeBorsch: not that I know. That's similar to the problem of asking for proof of the existence of a deity, though. The most important point in the comment is that the probability values given hold for a single bit. You need 8 for a single byte and if you know what that means to the overall probability you will not want to look into the range of Mebibytes anymore. There once existed "The Great Zero Challenge" which wasn't accepted. Of course we could come up with a conspiracy theory as to why. AFAIR the old method was to extract "shadows" of the data between tracks on a disk. –  0xC0000022L Jul 17 at 13:37
    
@0xC0000022L yeah, I know the probability formulas, but they apply only if these "random" values are really independent... so in theory there could be some unknown issues –  Sarge Borsch Jul 17 at 13:45
    
by the way, using a FDE is better, because "forgetting" one password is faster than permorming even the fastest wipe –  Sarge Borsch Jul 17 at 13:47

Taking care of your personal privacy concerns without messing your company's IT staff around unnecessarily is best accomplished at a file or folder level. Replacing the physical drive is looking for warranty trouble, if your overwrite the contents of the entire drive you'll take the recovery partition with you. Even just scrubbing the system drive means they'll have to do a lot of patching to get up to date unless the machine is very new or all machines are installed from a maintained image.

Get a file shredding tool (unfortunately I wouldn't know which of the many available options to recommend) and use it to destroy the cache and cookie directories for the browsers, log directory for Skype, the personal folders file for your GMail, etc. Finding the locations of all these items will take some research, but the file shredding process (overwriting the contents of the file with random or zero data) will put their recovery beyond the reach of a corporate IT team.

share|improve this answer
2  
I disagree. File shredding is a very time-consuming process especially when you don't know what you're shredding. He mentioned skype log. It is in fact all within a folder, no biggie. But then he proceeded with browser cache...seriously, there's no sane way to clean that mess up. –  Christian Mar 7 '11 at 15:24
1  
Oh and by the way, shredding files on SSDs is completely useless, just so you know... –  Christian Mar 7 '11 at 15:30
5  
Yes, the effectiveness of the shredding operation is dependent on a fixed or physical mapping between a block number and piece of non-volatile storage. This works for spinning media but not for SSDs which virtaulise their blocks for performance and lifecycle reasons. So the shredding model is ineffective on SSDs (and many SANs for that matter). The more interesting thing is that the persistence of data in free space on an SSD is completely unpredictable. It may also get completely erased in the absence of a scrubbing operation through the drive's free space preparation process. –  Bell Mar 7 '11 at 17:38

To wipe your hard drive, I highly recommend DBAN. It is free software and implements well-vetted algorithms for scrubbing hard drives.

For scrubbing a SSD, I have no idea what to use.

share|improve this answer
6  
For scrubbing an SSD I would recommend a pneumatic press and/or thermite. If you do both, just keep in mind that order of operations does matter. –  Scott Pack Mar 10 '11 at 4:37
    
@ScottPack - <grin> The interaction of Thermite with hydraulic oil could also be pretty interesting if you try to do the operations simultaneously... The alltime best is the use of a .50 cal sniper rifle to penetrate a stack of hard drives. You can do about 18 half-height drives at once. –  Fiasco Labs Jan 6 '12 at 5:40

As others have noted, wiping a flash drive or SSD is very different than wiping a hard drive. See Jesper Mortensen's answer on wiping flash drives for the details.

share|improve this answer

Many companies have a standard image for all PCs (or a small number of standard images). You could just delete a few key system files, thus rendering the machine unbootable. The IT department will reimage it, and all your files will be gone. Your files might be recoverable, but unless you've been doing some really "interesting" things with your company laptop, chances are nobody will care enough to try to recover them.

share|improve this answer

There are two concerns. Most everyone is focusing on what the company would do with the data. I would argue that the company would probably not care much and all of the data that they backed up would be secured against casual inspection. (This assumes you left on good terms.) A second concern is what would the employee who inherited your computer after you left find when they began using it? For that, just find and delete all your personal files and wipe all of the free space on the disk.

share|improve this answer

Completely wipe all browser caches/histories/passwords, etc.

Delete Skype database files, configurations and conversations.

share|improve this answer

For Win 7:

  • run %temp%, delete all those files that appear
  • clean the browser cache and cookies and passwords, etc.
  • do a file clean up in the accessories.
  • Uninstall programs from the control panel in Programs and features.
  • Make sure you remove internet toolbars from the programs and features because they can contain their own caching.
  • Check My Documents, My videos, my games etc.
  • run regedit from the run command. from there, go to HKEY_LOCAL_MACHINE. and then look for software, clean files there...
  • run cmd, then type ipconfig /flushdns.
  • after you backed up your hard drive first and then do the above, then run a defrag... by going to Start>ALL PROGRAMS>ACCESSORIES>SYSTEM TOOLS>DISK DEFRAGMENTER.
share|improve this answer
2  
Assuming it doesn't violate corporate policy DBAN is easier and more thorough. –  Scott Pack Dec 10 '12 at 15:39
    
All this deletion and defrag doesn't guarantee the data is irrecoverable, unless you add in a tool to actually wipe the free space. Even then, there's still lots of areas that might be missed. –  Iszi Dec 10 '12 at 15:41
4  
There's a lot of bad advice here. Manual cleaning of %temp% is bad, you should use Disk Cleanup for that. The advice about the registry doesn't even make any sense; the registry doesn't contain files at all. Even if you meant keys, what do you "clean up" in there? On top of all that, your steps here still don't actually have much benefit, and may actually make the system unstable. Furthermore, it's mostly security theatre - no real security benefit outside misplaced perception. Bad, bad, bad. –  Polynomial Dec 10 '12 at 15:46

protected by Jeff Ferland Dec 12 '12 at 22:11

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.