3

I just sold a Mac Mini, and I erased/formatted the hard drive before I turned it over, but I didn't wipe it securely (not wise, I know). How would a criminal take advantage of this fact? What is the probability of any of my sensitive files (passwords) being compromised after the buyer reinstalls the operating system?

This computer was not used for a lot, but I did use it to work from home and it may contain passwords for work-related things.

  • 1
    I think you're overestimating the ability (and desire) of the average computer user to recover data from a hard drive. It's unlikely that you happened to sell it to a person with ill intent that's going to dig through your hard drive to recover private data. I've bought plenty of used computers, and even though I have the knowledge to attempt to recover data, I don't have the time or even the interest. I'd bet that only a tiny fraction of computer purchasers even have the knowledge to do so. It's still a good idea to do a secure wipe, but don't worry too much if you didn't. – Johnny Nov 20 '15 at 8:45
  • 5
    I would panic, just incase someone like me bought your mac... I would have torn that apart by now. – TheHidden Nov 20 '15 at 10:09
  • You have the name and address of the person you sold the computer to and they know it as well (hopefully). It would be unwise for them to break into your online accounts though. – billc.cn Nov 20 '15 at 14:06
  • Not sure I agree @billc.cn – Neil Smithline Nov 20 '15 at 16:34
  • I think I am definitely overestimating, and it's probably because I'm paranoid. I don't think this guy's intention was to harvest my information, especially paying the price I sold it for. There are much easier (cheaper) ways to get used computers with information on it. I just am worried he is going to be tempted to recover files (I would be) just to see what used to exist on it. It is my hope that the more important files I stored won't be recognized or recovered. I tend to fear the mentality of @silverpenguin – wampum Nov 20 '15 at 22:18
5

My suggestion would be to change your work (and possibly other) passwords, just to be on the safe side.

It is quite easy to retrieve data, even after a format, with the proper tools. A quick Google search on "data recovery tools" reveal that a lot of (paid) tools are available to recovery data.

In my personal experience it was possible to retrieve data from a machine that was formatted during a new Windows installation. Even after the OS was re-installed I was able to get back all of the "lost" data.

Although the likelihood of someone doing this is low, you shouldn't take any chances on your passwords. At this point I do consider them compromised.

1

How would a criminal take advantage of this fact?

Assuming that the criminal wants to recover data from your old machine they will likely remove the hard drive and connect it to another system which can read it directly.

If it was encrypted (I assume not?) they will probably realise this pretty quickly and they'll abandon the exercise and sell the machine on.

If not encrypted data recovery tools can be used and probably get just about everything that was on the drive, including stuff that you may have deleted a long time ago. The result is broadly equivalent to someone having access to your machine if you leave it logged in and unattended.

If they are after something specific and have some technical knowledge (i.e. they know how to do what the data recovery tools are automating) they could target specific 'patterns' on the disk, which will enable them to focus on what they are after and only recover what is 'important'...if they can find it. This has the potential to recover far more information because it is not constrained by the limitations of file recovery software and can find information in corrupted or partially overwritten files.

What is the probability of any of my sensitive files (passwords) being compromised

There are people around, including criminals, who will specifically go after secondhand machines to recover data from them, though not necessarily for nefarious reasons, for example many years go I used to buy old hard drives when learning evidence collection and data recovery techniques. It is unlikely that you have sold your old machine to someone like that, but it is possible.

If the disk was encrypted - low probability.

If the disk was not encrypted:

  • Information stored in a text document, or similar, almost a certainty.
  • Cached passwords may or may not be recoverable depending on the application.

I suspect, though I have no evidence to back this up, that credentials stored in keychain will not be vulnerable without a brute force attack or knowledge of your login password.

1

If it was encrypted it should be fine (assuming strong encryption algorithm and strong password).

If not an attacker that has purchased your computer might be able to retrieve files containing session cookies or authentication tickets for sites and services you were logged into.

If you are concerned then reset your password on all sites, and terminate all other open sessions for sites and services that support this (e.g. Google, Facebook and Dropbox allow expiration of sessions on other devices).

0

PhotoRec is a tool that can be used to recover "accidentally" deleted photos and files. This tool can also be used to recover data after a drive was reformatted. A malicious buyer could use this tool to recover your old files.

In a defensive tactic, you could use the tool on your own future machine prior to selling it, in order to determine which files could be recovered.

  • Wouldn't it be easier to just wipe the drive (and possibly reinstall the OS), which would all but guarantee that the data is not recoverable by software methods? – a CVn May 5 '16 at 19:18
  • Writing over the data with one pass of 0's would have been sufficient, but in this scenario not even that was done. – wampum May 6 '16 at 23:10
  • Your (very own) question was how someone with ill intentions could take advantage of the fact that the drive was not wiped. Suggesting in response that one could use a tool that attempts to recover data before handing over the drive is not very useful; it's a lot more useful, and a lot more likely to produce consistent results, to just wipe the drive instead. Plenty of tools exist that are either designed to do that, or can be pressed into service of doing that. – a CVn May 7 '16 at 17:41
  • @MichaelKjörling I was merely noting one very easy way (that I discovered later) that an attacker could use a free and widely available tool to accomplish his ill intentions. And suggesting that the paranoid could (in the future, not this scenario) wipe their drive, and then run the tool to verify if anything was actually recoverable. – wampum May 9 '16 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.