19

Obviously this is very open-ended. But, I'm just paranoid about people going through everything on my laptop after I leave my job. Here are the things I'm planning to do:

  1. Completely wipe all browser caches/histories/passwords, etc.
  2. Delete my Skype database files and configurations so that nobody can log into my account for view my old messages.
  3. Delete the Outlook data file for my gmail account, and the archive files for my work e-mail. I realize there's nothing I can do about the e-mails on my work e-mail account that are on the mail server... unless somebody has an idea?
  4. Delete anything non-work related from the hard drive. Though, from what I understand, there are ways of restoring deleted files from a hard drive, right? Is there any way to prevent that, short of doing a DOD wipe on the entire drive?

That's about all I can think of. Does anyone have any other suggestions? Is there anything that the IT people might try to do that I'm not aware of? I'm not trying to hide anything weird or illegal; I'm just concerned about my personal privacy.

Thanks.

Matthew Peters
  • 3,592
  • 4
  • 21
  • 39
Tedderz
  • 291
  • 1
  • 2
  • 3
  • 15
    I believe there was a particular stapler-obsessed man who worked at Initech that had a pretty good solution to this problem. – James Santiago Mar 09 '11 at 21:48
  • On my last day of a former consultancy, I took the drive out of my Windows laptop, did a 7-time write-over format of my drive and installed linux. Then I simply told IT I had to install Linux and asked if they wanted me to put Windows back on. They smiled and said, "no, don't worry we'll just re-image it.. no problem." The risk was low. However, you'd have to be nuts to pull something like this at a Finance or Healthcare company where IT is ever-watchful. – Josh Hibschman Aug 12 '15 at 14:36

11 Answers11

20

The proper answer for this question is very situational, and dependent upon the policies and procedures in place at your company. Many companies have in place methods of backing up portions of the drive meant for user data, or even the entire drive, across the corporate network. If they've performed such backups on your system, there's nothing you can do to prevent them from accessing your data.

Beyond that, if your company allows, the only things you can do to definitively prevent restoration of your data off the laptop drive, is to do a secure wipe of that data or the whole drive, degauss, or outright destroy the drive.

EDIT: While the above discusses what you might be able to do about your privacy now, there really is a larger issue at hand.

If you're really concerned about your personal privacy, don't use corporate resources for personal purposes. Most companies have included in their Acceptable Use Policy or similar documentation, a clause that specifically says you may be subject to monitoring and have no expectation of privacy when using their systems. In many jurisdictions, this means that they can do whatever they want to observe and record your activities with or without your explicit consent (generally, your consent is given implicitly upon your agreement to the AUP) and/or knowledge - causing any retroactive attempts at personal privacy to be futile and ineffective.

Case in point: At one former workplace, I heard of a user who decided to do some, let's say, "very personal" web browsing on a company laptop while he was on his home network. Apparently he was under some delusion that whatever he did with the company's hardware was none of their concern if he did it on his own Internet connection. To be safe though, I'm sure he had some good history cleaning software in place and in use. He was also technically savvy enough that he probably did some manual cleaning of his own, periodically.

What he didn't know was that the company had monitoring software installed locally and running in the background. This software would record his Internet activities at all times, and relay the logs to the corporate servers whenever the laptop was connected to the intranet. You can imagine the resulting disciplinary actions when this occurred.

TL;DR: Keep your business on your hardware, and company business on company hardware.

Iszi
  • 26,997
  • 18
  • 98
  • 163
  • I agree. This is the correct (sane) answer out there. Wasting *days* cleaning up the mess programs like web browsers leave behind is not even worth it. – Christian Mar 07 '11 at 15:27
  • 4
    Yep - most larger companies will have your computer backed up somewhere to comply with their disaster recovery/business continuity policy. Best to assume your details will remain in their archives for a long time :-) – Rory Alsop Mar 07 '11 at 17:11
  • 2
    You cannot erase what you've already left behind. I keep telling the incredulous this, but no amount of erasure gets rid of the past that has passed through the network. It gets backed up somewhere for unknown retention periods (that forgotten DVD at the back of the locker) and that which passes outside the company may have a lifetime of forever. – Fiasco Labs Jan 06 '12 at 04:02
10

I'll put my proper IT hat on - still just about fits - and suggest you could try asking your IT team what their process is - the answer might reassure you.

Typically, IT are going to make a "just-in-case" backup of your drive and put it on a shelf ("just-in-case" management realises a year after you've gone that you had a file on your drive that is urgently needed) and then wipe the whole thing themselves before re-imaging. We're not interested in your Skype logs, we just want to turn the hardware round as fast as possible.

InfoSec hat back on, and I have a sudden urge to update our guidelines with what to do if someone asks that question. We'd want to be very calming and reassuring, while holding them in the room long enough for HR to search their desk and IT to image their laptop and network shares.

Graham Hill
  • 15,394
  • 37
  • 62
5

Considering the amount of stuff you're mentioning, I would wipe out the drive entirely. You can run some software to fill the drive with garbage a couple of times. Better still, take the drive with you, or burn it up :)

Edit: I think swapping their drive with a new one is entirely reasonable, at a reasonable cost too. Depends on company policies, most probably.

Christian
  • 343
  • 1
  • 9
  • 2
    "Better still, take the drive with you, or burn it up" - assuming the company has no recourse for theft or destruction of its property...which they usually do. –  Mar 07 '11 at 14:34
  • 2
    Of course that would have to be arranged, but we're in security, not law ;) – Christian Mar 07 '11 at 15:23
  • 4
    Overwriting multiple times is an urban legend. See my comment to SteveS' answer. See, for example, Wikipedia (Gutmann method): "Most of the patterns in the Gutmann method were designed for older MFM/RLL encoded disks. Relatively modern drives no longer use these older encoding techniques, making many of the patterns specified by Gutmann superfluous." – 0xC0000022L Mar 08 '11 at 03:34
5

Wipe the disk with something government approved. Given that most companies have policies around using work computers for personal stuff, it seems like they would be fairly lax around receiving a wiped drive.

Then again, you are leaving anyway, so it wouldn't really matter.

Steve
  • 15,155
  • 3
  • 37
  • 66
  • 5
    Actually this is more an urban legend than based on facts. Overwriting with zeros is enough. The probability values to restore data are for single bits, combine that into a byte or the size of a cluster and the chance to recover is sooooo minimalistic that it's not worth mentioning. The original methods for multiple overwriting were developed for tape and floppy drives and are no longer suitable. – 0xC0000022L Mar 08 '11 at 03:32
  • @0xC0000022L Sounds reasonable, but is there a proof on the Internet? – Display Name Jul 17 '14 at 11:29
  • @SargeBorsch: not that I know. That's similar to the problem of asking for proof of the existence of a deity, though. The most important point in the comment is that the probability values given hold for a single bit. You need 8 for a single byte and if you know what that means to the overall probability you will not want to look into the range of Mebibytes anymore. There once existed "The Great Zero Challenge" which wasn't accepted. Of course we could come up with a conspiracy theory as to why. AFAIR the old method was to extract "shadows" of the data between tracks on a disk. – 0xC0000022L Jul 17 '14 at 13:37
  • @0xC0000022L yeah, I know the probability formulas, but they apply only if these "random" values are really independent... so in theory there could be some unknown issues – Display Name Jul 17 '14 at 13:45
  • by the way, using a FDE is better, because "forgetting" one password is faster than permorming even the fastest wipe – Display Name Jul 17 '14 at 13:47
  • @SargeBorsch: admittedly. And I agree about full-disk encryption. Assuming it's secure. Depends on your own level of (un)healthy paranoia. FDE also gets rid of the SSD problem mentioned before. – 0xC0000022L Jul 17 '14 at 13:52
  • I think that paranoia is healthy in general :) – Display Name Jul 17 '14 at 13:57
4

Taking care of your personal privacy concerns without messing your company's IT staff around unnecessarily is best accomplished at a file or folder level. Replacing the physical drive is looking for warranty trouble, if your overwrite the contents of the entire drive you'll take the recovery partition with you. Even just scrubbing the system drive means they'll have to do a lot of patching to get up to date unless the machine is very new or all machines are installed from a maintained image.

Get a file shredding tool (unfortunately I wouldn't know which of the many available options to recommend) and use it to destroy the cache and cookie directories for the browsers, log directory for Skype, the personal folders file for your GMail, etc. Finding the locations of all these items will take some research, but the file shredding process (overwriting the contents of the file with random or zero data) will put their recovery beyond the reach of a corporate IT team.

Bell
  • 975
  • 9
  • 12
  • 2
    I disagree. File shredding is a very time-consuming process especially when you don't know what you're shredding. He mentioned skype log. It is in fact all within a folder, no biggie. **But then he proceeded with browser cache...seriously, there's no sane way to clean that mess up.** – Christian Mar 07 '11 at 15:24
  • 1
    Oh and by the way, shredding files on SSDs is completely useless, just so you know... – Christian Mar 07 '11 at 15:30
  • 5
    Yes, the effectiveness of the shredding operation is dependent on a fixed or physical mapping between a block number and piece of non-volatile storage. This works for spinning media but not for SSDs which virtaulise their blocks for performance and lifecycle reasons. So the shredding model is ineffective on SSDs (and many SANs for that matter). The more interesting thing is that the persistence of data in free space on an SSD is completely unpredictable. It may also get completely erased in the absence of a scrubbing operation through the drive's free space preparation process. – Bell Mar 07 '11 at 17:38
4

To wipe your hard drive, I highly recommend DBAN. It is free software and implements well-vetted algorithms for scrubbing hard drives.

For scrubbing a SSD, I have no idea what to use.

D.W.
  • 98,420
  • 30
  • 267
  • 572
  • 8
    For scrubbing an SSD I would recommend a pneumatic press and/or thermite. If you do both, just keep in mind that order of operations *does* matter. – Scott Pack Mar 10 '11 at 04:37
  • @ScottPack - The interaction of Thermite with hydraulic oil could also be pretty interesting if you try to do the operations simultaneously... The alltime best is the use of a .50 cal sniper rifle to penetrate a stack of hard drives. You can do about 18 half-height drives at once. – Fiasco Labs Jan 06 '12 at 05:40
3

As others have noted, wiping a flash drive or SSD is very different than wiping a hard drive. See Jesper Mortensen's answer on wiping flash drives for the details.

Community
  • 1
nealmcb
  • 20,544
  • 6
  • 69
  • 116
1

There are two concerns. Most everyone is focusing on what the company would do with the data. I would argue that the company would probably not care much and all of the data that they backed up would be secured against casual inspection. (This assumes you left on good terms.) A second concern is what would the employee who inherited your computer after you left find when they began using it? For that, just find and delete all your personal files and wipe all of the free space on the disk.

Les
  • 443
  • 3
  • 9
0

Many companies have a standard image for all PCs (or a small number of standard images). You could just delete a few key system files, thus rendering the machine unbootable. The IT department will reimage it, and all your files will be gone. Your files might be recoverable, but unless you've been doing some really "interesting" things with your company laptop, chances are nobody will care enough to try to recover them.

Jonathan
  • 209
  • 1
  • 3
-1

Completely wipe all browser caches/histories/passwords, etc.

Delete Skype database files, configurations and conversations.

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
Fizzaali
  • 1
-4

For Win 7:

  • run %temp%, delete all those files that appear
  • clean the browser cache and cookies and passwords, etc.
  • do a file clean up in the accessories.
  • Uninstall programs from the control panel in Programs and features.
  • Make sure you remove internet toolbars from the programs and features because they can contain their own caching.
  • Check My Documents, My videos, my games etc.
  • run regedit from the run command. from there, go to HKEY_LOCAL_MACHINE. and then look for software, clean files there...
  • run cmd, then type ipconfig /flushdns.
  • after you backed up your hard drive first and then do the above, then run a defrag... by going to Start>ALL PROGRAMS>ACCESSORIES>SYSTEM TOOLS>DISK DEFRAGMENTER.
Polynomial
  • 132,208
  • 43
  • 298
  • 379
techgirloftheyear
  • 1
  • 2
    Assuming it doesn't violate corporate policy DBAN is easier and more thorough. – Scott Pack Dec 10 '12 at 15:39
  • All this deletion and defrag doesn't guarantee the data is irrecoverable, unless you add in a tool to actually wipe the free space. Even then, there's still lots of areas that might be missed. – Iszi Dec 10 '12 at 15:41
  • 4
    There's a lot of bad advice here. Manual cleaning of `%temp%` is bad, you should use Disk Cleanup for that. The advice about the registry doesn't even make any sense; the registry doesn't contain *files* at all. Even if you meant keys, what do you "clean up" in there? On top of all that, your steps here *still* don't actually have much benefit, and may actually make the system unstable. Furthermore, it's mostly security theatre - no real security benefit outside misplaced perception. Bad, bad, bad. – Polynomial Dec 10 '12 at 15:46