0

I have an old computer that is no longer working and I want to donate it or perhaps throw it in the trash. However, I don't want people to potentially get my banking account data, usernames/passwords I have entered on the computer, software installed, legal or medical documents, internet browser data, etc. I am going to keep the hard drive, should I do something more to the computer before getting rid of it?

2
  • 1
    Two possible option, give computer with new HDD or degaussing will help to remove Magnetic HDD data. degaussing is not possible for SSD. Purging also good but reliable. – Infra Apr 5 at 16:26
  • @Infra - Degausing a hard drive will wipe the control tracks, turning the drive into a useless brick. – user10216038 Apr 5 at 18:36
1

Donate your Laptop without a hard driver or replace it by a new one, there a many forensics tools able to restore the deleted data (password, files, visited URLS...)

Deleted files

A common technique used in computer forensics is the recovery of deleted files. Modern forensic software have their own tools for recovering or carving out deleted data.[11] Most operating systems and file systems do not always erase physical file data, allowing investigators to reconstruct it from the physical disk sectors. File carving involves searching for known file headers within the disk image and reconstructing deleted materials.

Data recovery

1
  • The question has been clarified to say that the hard drive is being removed – schroeder Apr 6 at 11:54
1

You are looking to protect the data from accidental leakage or from someone with limited IT knowledge, such as an administrator who knows how to look at drive space marked as "free" by the operating system but still containing data.

For these purposes, a good low-level wipe should do. A lot of information on the Internet is outdated and claims data can be recovered by this and that method, but the reality is that the increase in data density on drives has rendered most of those methods obsolete.

The easiest way is probably using a bootable CD with Linux and either a dedicated tool or the commandline dd command. Here is a link doing this with Ubuntu and here is a much simpler approach using DC3DD. There are also two questions on AskUbuntu about this.

If you are using dd, I would recommend overwriting it three times. Once with zeroes, once with ones and once with random bytes. Make sure you overwrite the whole disk. While there may be theoretical ways to recover at least partial data after that, they are outside of the capabilities of the threat actors in your described scenario. As long as you don't try to hide data from the Mafia or a spy agency, you should be good.


Update

If you keep the harddrive, then securely erasing it isn't the problem. Make sure there's no built-in SSD that the system might be using for caching (some early SDD-accelerated systems had external caches).

RAM should be impossible to recover to any threat actor in your scenario. You can boot the system from a live CD and run a memory test if you want, which will write and read all the RAM, but that's already overkill.


Addendum:

This is one more reason why you should always have the drive encryption active on all your systems. Then you don't have to worry about data loss.

3
  • A three times wipe is unnecessary. – user10216038 Apr 6 at 15:29
  • The OP syas that the drive is not being given away, so all the advice about the drive is moot, isn't it? – schroeder Apr 6 at 16:02
  • @schroeder if preventing a data leak is the only reason to keep the drive - it's not necessary. If your adversary is the CIA or the FSB, by all means keep the drive, shred it, degauss the pieces, scatter them to the winds and bury the big pieces in seven different locations on seven continents - but for someone whom you don't even think to be malicious, just maybe a bit curious if an opportunity presents itself, it's not needed to go beyond basic protection measures. – Tom Apr 7 at 6:16
-1

There are easy and effective free wiping tools such as DBAN https://sourceforge.net/projects/dban/. There's a walk-thru guide at https://www.lifewire.com/how-to-erase-a-hard-drive-using-dban-2619148.

Dban and other tools are generally very simple and effective, however there are specialized edge cases that are possible and verification is left to you.

If you don't have the knowledge to perform your own verification, decide what the very low probability of risk is relative to the hard drive cost you are trying to save. If you still have concerns, just physically destroy the drives.

Update based upon new statement of removing the drives.

The above answer still applies to your drives and any potential reuse.

Nothing else in a typical machine stores persistent personal data, so you should be good to go.

1
  • The question has been clarified to say that the hard drive is being removed – schroeder Apr 6 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy