I recently went to a local large Canadian computer retailer to purchase some hard drives. The sales clerk told me they had some "open box" drives which had been used in the store and were slightly discounted due to this. Since I was going to wipe the drives before using them, I figured it was a good deal.
Before wiping them, I took a look to see if there was in fact any data left on them. Within a few minutes and using some digital forensic software (see my other postings about free data recovery tools), I found lots of personal data (including tax documents and pornography) from someone who had obviously used the drive before.
Obviously a little concerned by this, I called the store and was told that yes, they do resell "used" drives as "open box" and they only quick format the drives and do not wipe them when they get them back from customers. They did not seem overly troubled that I found customer data. I was a little shocked that a) the company was selling "used" items as "open box" and b) the lack of concern of not protecting their customers personal information. I called the head office, was thanked for informing them, and was told that they would not change the policies of returned items.
As I have stated in other posts, if you decide to recycle or throw out your old technology, you should consider destroying or wiping the drives. In this case, the prior customer obviously needed to return the computer, so destroying it would not be an option. There are other articles online that walk you through the steps of how to wipe a drive.
This posting though is not about wiping your drives; it is about whether you should purchased used technology. The main reason people purchase used/refurbished technology is obviously for the cost savings. There are however some issues to consider before purchasing used devices:
1. Is the item stolen?
This shouldn't be a concern if you are buying from a reputable seller. I would be concerned about buying stolen goods if you are buying from some online classified sites like Craigslist and Kijiji. Use common sense when purchasing items from someone who do not know. There are also various webpages that allow you to check to see if in fact the mobile device you are thinking of buying is stolen. This is not as easy to do if you are purchasing a computer or other digital device.
2. Are there viruses or other malware on the device?
While formatting the drive is a great way to get rid of most viruses and malware, there is no guarantee that it will get rid of everything. Can you be sure that the retailer that you are purchasing your used device from followed proper procedures? This especially is the case if you are not buying your device from a reputable retailer. A system (or component) purchased from a classified ad website may be loaded with viruses, key loggers or may even allow someone remote access into that device.
3. Is there data on the device that might land you in trouble?
As you can see by my example above, just because you purchase a device from a reputable retailer, does not mean that they have taken the proper steps to wipe that device before selling it to you. The person who owned the device prior to you might have been up to no good and you might have illegal content on your device. While the chances of you stumbling across this data would be slim, if you ever took your device for data recovering services, the prior owners data might also be recovered.
What can you do?
- Only purchase from reputable sources, or at a minimum do some homework before purchasing (e.g. checking to see if device is stolen).
- Ask your local retailer about their policies. Does "open box" mean "used", and do they fully wipe all devices before reselling them?
- Consider reformatting and reinstalling the operating system (factory reset) if you do purchase a used device.