Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Privacy Data Storage Your Rights Online

Ask Slashdot: How To Deal With Refurbed Drives With Customer Data? 385

Posted by timothy
from the first-scan-for-gossip dept.
An anonymous reader writes "I just received 3 'refurbished' SATA drives from Newegg. All 3 had some sort of existing partition. Most appeared to be factory diagnostic partitions, but one had a full Dell Windows XP install complete with customer data. How big a deal is this? Should I contact someone besides Newegg about this?"
This discussion has been archived. No new comments can be posted.

Ask Slashdot: How To Deal With Refurbed Drives With Customer Data?

Comments Filter:
  • knowledge is power (Score:5, Interesting)

    by louic (1841824) on Thursday February 09, 2012 @10:32AM (#38981831)
    First, have a look at the data. Then decide.
    • by Anonymous Coward on Thursday February 09, 2012 @10:54AM (#38982241)
      You know what? You're right. I think I'll go ahead and do what I've been considering doing for some time now, and encrypt the hard drive of my laptop.
      • by networkBoy (774728) on Thursday February 09, 2012 @11:27AM (#38982741) Homepage Journal

        *this*
        encrypt your drive before it fails, because once it fails you can not control the data if you want to return the drive.
        I have eaten drives before rather than warranty returns because the data was sensitive (IMHO) and I do not trust every person in the chain to not snoop on the drive's contents.
        -nB

    • by ackthpt (218170) on Thursday February 09, 2012 @10:59AM (#38982307) Homepage Journal

      First, have a look at the data. Then decide.

      Just because you have it doesn't justify any actions you take based upon it. Erase it. Make sure it's completely gone. Then notify Newegg their Refurbies are morons, putting them at legal risk, as well.

      • Re: (Score:3, Insightful)

        by louic (1841824)
        Just looking at it won't hurt anyone. It's what you do after it that counts, and that depends on the data. Of course, notifying a company of their mistake is nice so they can make improvements in the future. Where I come from, people help each other instead of even thinking about "putting them at legal risk". Unfortunately though, it is also my experience that most companies don't care.
        • by forkfail (228161) on Thursday February 09, 2012 @11:22AM (#38982665)

          Just looking at it won't hurt anyone.

          Unless, of course, there is an unencrypted version of the Dark Book of The Elder Gods on the drive....

        • by CastrTroy (595695)
          Perhaps you can identify the original owner. If the original owner is some large company, perhaps they can help convince hard disk manufacturers from selling drives that haven't been wiped. A single person complaining to Newegg might not help much. A large corporation which buys hundreds or thousands of drives a year giving their hard drive vendor a hard time might help to change things.
        • by UnknowingFool (672806) on Thursday February 09, 2012 @12:02PM (#38983347)
          Looking at the data legally puts you at risk. The other company may care. If the data was government/military, there's a headache you don't want. Erase it immediately so there is no question. While no one can prove you looked at it or not, no need to make it worse on you.
          • That's useless paranoia. The drive needs to be identified, in terms of ownership, the prior owner notified. It's THEIR data. Then complain noisily to vendor, and let your favorite social media site understand the problem.

            Vendors have no excuse for this kind of behavior. Worse users need to take ownership in their data, and understand what the privacy laws are all about. It should start with the user, but the vendor has an inspection job to do, too.

            Looking at the data is very unlikely to put you at any risk.

    • by tunapez (1161697) on Thursday February 09, 2012 @11:05AM (#38982401)

      Knowledge can be quite a burden, too.
      YMMV.

    • by steelfood (895457) on Thursday February 09, 2012 @11:07AM (#38982433)

      Same thing you do with every other mostly-dead drive: Go through it and look for pr0n.

    • by Anonymous Coward on Thursday February 09, 2012 @11:50AM (#38983129)

      I once went over an "unwiped" drive looking for pron. What I found was a folder of "racy" photos the previous owner took. Unfortunately she was twenty years older than me, had about 200 lbs on me, and had a penchant for butternut squash, a food I can not eat to this day.

      Knowledge is power, ignorance is bliss, and no amount of eye bleach will remove some images.

    • Must Wipe It (Score:5, Insightful)

      by Pitawg (85077) on Thursday February 09, 2012 @12:47PM (#38984217)

      No decision needed. Look all you want, but the liability is on you if someone decides your computer is of interest and data is questionable. Unless you report it to vender in a verifiable way, data on the drive, even if it was not yours, is now yours in any examination. Report it in writing or no evidence will exist to point in someone else's direction for liability.

      Wiping beyond technological limits of retrieval is important with both criminal liabilities and civil copyright liabilities. The odds of old data being a problem in your life may be low, but it would be icing on the cake with any situation bringing your drive to the attention of some types of investigations.

      Call it paranoia if you like, but why drive around in your new used-car with a suitcase in the trunk that came with the car without knowing precisely what is inside. Remove the suitcase, or examine every square inch of it looking for contraband..

  • Two choices... (Score:5, Informative)

    by mlts (1038732) * on Thursday February 09, 2012 @10:33AM (#38981845)

    Choice #1: Send the drives back and demand ones without confidential data on them.

    Choice #2: Use a utility like HDDErase which uses low level ATA commands to tell the controller to wipe the drive. This will wipe every sector, even ones that are bad, relocated, or protected ones. After that, follow up with DBAN for good measure.

    After that, don't worry about it.

    • Re:Two choices... (Score:5, Informative)

      by jhigh (657789) on Thursday February 09, 2012 @10:38AM (#38981933)
      I would definitely let Newegg know about this. This is potentially a very serious issue for their customers.
      • Re:Two choices... (Score:5, Insightful)

        by Joce640k (829181) on Thursday February 09, 2012 @10:50AM (#38982161) Homepage

        Is it Newegg's job to wipe the drives?

        I would have thought it's up to the original owner to make sure there's nothing important on there.

        • Re:Two choices... (Score:5, Insightful)

          by BlackSnake112 (912158) on Thursday February 09, 2012 @10:54AM (#38982235)

          Refurbished drives usually mean the drive failed, was sent in for repair and now is being resold. You can wipe a failed drive? If the motor died, how can you wipe it? The average person does not have the utilities to wipes a failed drive. Whoever refurbished the drive should have wiped it, not newegg.

          • Re:Two choices... (Score:5, Insightful)

            by rickb928 (945187) on Thursday February 09, 2012 @11:10AM (#38982469) Homepage Journal

            This drive was not refurbished . At best it was put through a cursory test and passed. Newegg failed twice: once, not actually refurbishing the drive , and second not wrong it. Dishonest and incompetent in one pass.

            Or their outsourced team, still responsible.

            • Re:Two choices... (Score:4, Interesting)

              by rrohbeck (944847) on Thursday February 09, 2012 @12:20PM (#38983643)

              This.
              Refurbishing a drive means (among other things) a full media test which means writing every sector.
              These drives were probably plugged in and "OK, works, ship it!"

          • Re:Two choices... (Score:5, Informative)

            by director_mr (1144369) on Thursday February 09, 2012 @11:13AM (#38982519)
            No, refurbished drives do NOT mean the drive failed. It means someone returned the drive, and the thing tested good, or that someone returned a computer that they parted out, and the hard drive tested good. Bad hard drives are VERY rarely repaired, and only if it is a very easy, cheap and quick fix, and I can't think of any such repair except maybe unbend a pin or put the jumper on correctly, and SATA drives don't have either of those issues. They simply don't cost enough to justify repair.
          • Christmas Ornaments (Score:4, Informative)

            by ISoldat53 (977164) on Thursday February 09, 2012 @11:32AM (#38982799)
            If I have a HD that has failed I pull the disks out and use them for Christmas ornaments. I don't trust sending them back. The rare earth magnets are useful too.
        • Re:Two choices... (Score:4, Insightful)

          by AF_Cheddar_Head (1186601) on Thursday February 09, 2012 @10:55AM (#38982247)

          If the drive is truly "refurbished" NewEgg or its supplier should be testing the drive and in the process of testing the data should be wiped. Yes, I know that a "refurbished" drive has not been fixes but at least it should be tested and wiped to ensure that it meets OEM specifications.

        • by hrieke (126185)

          No, but they *can* communicate with the drive manufacturer to have them put into place a policy & procedure to ensure that the drives *are* wiped clean before being shipped out.
          Actually, since there is data on the drive, I would wonder exactly how well tested the drive was before being sent to Newegg for sale.

      • Re:Two choices... (Score:5, Insightful)

        by hairyfeet (841228) <bassbeast1968 AT gmail DOT com> on Thursday February 09, 2012 @10:57AM (#38982295) Journal

        I agree that Newegg should be told, as they may have a problem in their supply chain. Who knows what company they are buying these refurbs from and I'm sure they have in the contract they are supposed to be zeroed and testing prior to shipment. That said I always give any new drives a quick zeroing out just in case, you never know even on a new drive if some manufacturer in China is gonna have a bug on that machine that is formatting the drives and then a quick runthrough with spinrite on level I just to make sure they are good. For those who have never used the program spinrite on level I simply bypasses the firmware so the drive can't replace bad sectors with spares and then does a simple write/read/erase where it writes to each sector once and ensures that it can read the data before going on to the next. if a drive can't do a simple read/write without significant bad sectors it simply isn't worth trusting data to.

        But I've had quite good luck with refurbs from both Newegg and Tigerdirect and if a drive passes spinrite level I it'll be no more risky IMHO than any other drive. You'd be amazed though at how many companies sell or toss drives with data on them, I had a friend working at one of the big telecos as a temp hand for their big computer upgrade and he calls me and says "Hey bud, you still got your truck? good why don't you come out here and bring it around back, they are just chunking their previous systems and most are loaded to the gills with excellent hardware and they said anybody that wants to can help themselves" so when i get there he loads what can't be more than 3 year old Dell workstations nearly to overflowing in my truck, around 60 in all. I get them back to the shop and go to fire one up to see what the BIOS says and missing the BIOS prompt it starts to boot! Sure enough the full OS is there, no password, and there is still all kinds of customer data on these things! I of course Dbanned the drives but if I would have been a bad guy it would have been like Xmas.

        If what I saw was typical no wonder we have so many data breaches, but it really doesn't surprise me this guy ended up with drives that had data, picking up off lease systems I find that kind of thing all the time.

      • by tomhudson (43916) < ... <nosduh.arabrab>> on Thursday February 09, 2012 @11:04AM (#38982387) Journal
        Someone along the chain swapped the RMA'd drive for one they had hanging around. They get a refurbed drive with (hopefully) more lifetime left before failure (and the ability to return it if it does die), you get a ticking time bomb and no warranty.
      • Re:Two choices... (Score:5, Informative)

        by TheGratefulNet (143330) on Thursday February 09, 2012 @11:18AM (#38982603)

        don't bother. they know about this. they DECIDE to ignore some things.

        open-box and returns from newegg are bad, bad, bad!.

        I buy a lot from NE. but I got burned on open-box things enough that I now refuse to do it anymore.

        last purchase was an intel ssd. it was the only one left (a year ago) and it was a customer return.

        silly me to think NE even tests things. they do not! they admitted as much on a voice call to me. I was so mad but nothing I could do about it other than not buy from them anymore (only new things, now).

        the ssd must have been someone's 'joy ride test' and NE didn't even test it. it worked for a few weeks in my system and - bad for me - I didn't use that system much during the next several months. I finally powered it on and it was no end of disk errors. the ssd was fried. when I called NE to complain they said that they just rebox things and send it out. its YOUR job to verify it works.

        O. M. G.

        what a lesson ;(

        don't get burned. don't buy open box from newegg. I like NE in most ways but they totally screwed me and themselves on that one.

        DO NOT BUY USED GEAR FROM NEWEGG. I have to put it in all caps since its a major issue and you WILL get burned; its just a matter of 'when'.

    • by g0bshiTe (596213)
      I agree, keep them, you bought them knowing they are refurb. It means someone didn't do their job properly and wipe their data, both the original owner of the drive and the reseller (it's likely not New Eggs fault). You should wipe them, and let New Egg know there was data on them so they can inform their supplier.
      • Most of the time, there's not a whole lot the original owner can do if it's a consumer-grade hard drive. I believe some enterprise laptop hard drives are encrypted by a key that can be blown away (rendering the data on the drive into digital noise) regardless of whether or not the drive is working properly, but it's rare for consumer (or enterprise drives used in servers, for that matter) to make use of the feature because it reduces your odds of ever performing successful data-recovery on the drive down to

    • Re:Two choices... (Score:5, Interesting)

      by Korin43 (881732) on Thursday February 09, 2012 @10:44AM (#38982043) Homepage

      Instead of choice 1 and choice 2, I would say step 1 and step 2:

      1. Inform Newegg that there's a problem with their process (considering this is on Slashdot, this may already be done).
      2. Erase the drives.
      3. ???
      4. Profit

    • Re:Two choices... (Score:5, Informative)

      by wjousts (1529427) on Thursday February 09, 2012 @10:46AM (#38982081)

      Why even bother with industrial grade hard drive whipping? It's not you data, so who cares. Just a regular erasing should be fine. If I was the questioner, I would probably just repartition, format and get on with it.

      A quick e-mail to New Egg to bitch them out might be worthwhile too.

      • Re: (Score:2, Insightful)

        by vortechs (604271)
        Depends on the data on the drive. If there's instructions for building explosives, child porn, or something similarly problematic (depending on your current locale) on there, and you don't do a industrial grade wipe, it could be an issue for you later...
        • by TheCarp (96830)

          That was my thought exactly. There was a story just the other day about a thief who stole a couple of cell phones from a car. He found child porn on the phones, and turned himself in. The judge gave him 1 month in jail... because he neither wanted to encourage theft nor discourage reporting child porn, and the guy also had stolen a car previously....

          In any case...my thought was...good thing he looked! Good for the kids obviously, but, him too. How much of a mess would that have been had he been picked up fo

      • Re:Two choices... (Score:4, Insightful)

        by JosKarith (757063) on Thursday February 09, 2012 @10:54AM (#38982229)
        And then your house gets raided because you've been naughty enough to download an episode of Glee. Under forensic examination your main data drive seems to have 45Gb of deleted pr0n, some of it CP.
        Suddenly you're in a whole new world of hurt that involves trying to prove to a justice system that goes for the simplest possible answer that you didn't put it there...
      • Why even bother with industrial grade hard drive whipping?

        Perhaps they're into HDSM.

    • by Lucas123 (935744)
      What about SSDs? Does HDDErase work for flash?
    • Re:Two choices... (Score:5, Informative)

      by Anonymous Coward on Thursday February 09, 2012 @11:59AM (#38983303)

      Choice #2: Use a utility like HDDErase which uses low level ATA commands to tell the controller to wipe the drive. This will wipe every sector, even ones that are bad, relocated, or protected ones. After that, follow up with DBAN for good measure.

      You need to become more familiar with the underlying storage protocols before stating things like this. Let's get to the facts, preferably technical ones, because this is Slashdot. What you've said is mostly nonsense (not entirely though), so let me go over it with you:

      1) There is no such thing as a "low-level ATA command". ATA commands are as "low-level" as it gets with communication between disks and controllers -- controller status bits are a different thing, and are not managed/viewed via ATA, they are done via PCI BAR or memory-mapped I/O. The "command" you are talking about with regards to HDDErase is part of standard ATA8-ACS specification (probably earlier), known as SECURITY ERASE UNIT (command 0xF4). This is verified here [wikipedia.org].

      2) HDDErase issues SECURITY ERASE UNIT, which is a firmware-level erase that the drive does itself. On mechanical HDDs this is completely equivalent to issuing dd if=/dev/zero of=/dev/disk bs=64k -- except with SECURITY ERASE UNIT, you have no visibility into the progress of the erase, the software simply has to make "educated guesses". If you erase via an OS (meaning the underlying storage driver issues zeros to each LBA), you can get an idea of the progress and speed given that you know how many LBAs there are, and which ones you've written to. DBAN does the latter (though with its own program, not using dd -- but its C code does the equivalent).

      With SSDs, SECURITY ERASE UNIT actually does some extra magic, since the FTL that maps LBAs to NAND flash regions also gets reset (meaning you lose all wear levelling history). This doesn't happen with a standard "OS-level" erase.

      And I'll just throw this out there because some smart-ass will certainly bring it up: there is absolutely no "low-level format" equivalent on ATA/SATA disks unless the vendor chose to implement a non-ATA-standard ATA command that does it. I repeat: THERE IS NO LOW-LEVEL FORMAT COMMAND. SCSI, on the other hand, even today still has a low-level format command. This command on SCSI merges the grown defect list into the physical defect list. ATA/SATA does not work this way -- keep reading.

      3) Both methods I described above "wipe every sector". However, your claim that "it wipes even ones which are bad" is completely incorrect. The same goes for your "[even ones which are] reallocated (sic)". Bad (uncorrectable) sectors are PERMANENTLY bad. LBAs which are remapped (to point to sectors other than their actual LBA 1:1 equivalent) can point to any sector, of course. Sectors which are marked unusable DO NOT get touched by the drive with SECURITY ERASE UNIT or an OS-level format. I can expand more on this later, but it's probably best to read something someone familiar with storage wrote [dslreports.com] a few weeks ago for a user.

      4) Please explain what a "protected" sector is. I believe you're referring to the HPA region [wikipedia.org] of a disk. SECURITY ERASE UNIT does not do this, and no OS-level erase/zero can touch it. The HPA stores information like SMART attributes, the ATA GP log, hard disk model, serial number, capacity (LBA count), and many internal/vendor-specific things. It is possible to "reset" the HPA using utilities like mHDD, but if you read the (awful) docs for it, it will tell you flat out that this doesn't work on the mass majority of disks because it uses a vendor-specific ATA command that not all vendors implement, or if they do implement it, have security limitations applied to it (usually something magical like issue ATA command 0x45 with a specific CDB payload, watching for a result code of some value, then issuing a

  • DBAN (Score:3, Informative)

    by the real darkskye (723822) on Thursday February 09, 2012 @10:34AM (#38981857) Homepage

    http://dban.org/ [dban.org]

    Enough said.

    • Re:DBAN (Score:4, Informative)

      by hairyfeet (841228) <bassbeast1968 AT gmail DOT com> on Thursday February 09, 2012 @11:02AM (#38982345) Journal
      Actually there is a MUCH better tool friend, I'd suggest Hiren's Boot CD [hiren.info] instead. not only does it have Dban as well as a good dozen or more HDD utilities but it has just about every tool you'd ever need from password reset to system info to testing of all major components. It really is a Swiss army knife of system tools and can be run off the CD in Windows so you can use the tools without needing to boot off the disc first. Truly a great tool to have.
    • by forkfail (228161)

      Except that if you're returning a drive that doesn't work (e.g., failed controller), then you can't wipe the data.

      And if NewEgg isn't wiping it as part of their process, it means that the warranty you paid for is worthless, and that you really can't return any failed hard drives. Or laptops, for that matter.

  • Data Breach (Score:5, Insightful)

    by gellenburg (61212) <george@ellenburg.org> on Thursday February 09, 2012 @10:35AM (#38981875) Homepage Journal

    Technically it qualifies as a Data Breach Incident. Depending on the industry the original drive belonged to shit could hit the fan.

    The fault lies entirely with the original owner for not wiping the hard drive before returning the equipment. NewEgg is ot in the data wiping business.

    Of course the easiest thing for you to do would simply be to repartition it and reformat it.

    • Re:Data Breach (Score:4, Insightful)

      by forkfail (228161) on Thursday February 09, 2012 @10:38AM (#38981935)

      So - then are you saying that you should never RMA a failed HD? Because if NewEgg doesn't wipe drives as part of the refurbishment, then you can never send a drive back.

      • If you are at all concerned about your data, you should not RMA a failed disk.

        Now, I'm not entirely sure what the answer is to "my hard disk failed after 3 months - I want a new one under the warranty" for consumers, but when I was buying corporate stuff from Dell they had a service where I could pay a small additional fee per drive (something like £10 GBP) and get to keep the failed unit when they replaced it.

      • by hawguy (1600213)

        So - then are you saying that you should never RMA a failed HD? Because if NewEgg doesn't wipe drives as part of the refurbishment, then you can never send a drive back.

        I wouldn't send back a potentially repairable drive that has my personal data on it.

        At work, we have some drives that we're not legally allowed to return unless we can do a secure wipe of the drive (or the manufacturer will certify that they've destroyed the data). We had to pay extra for our storage array maintenance contract for non-return.

        I haven't had to return a consumer hard drive (yet), do they have to be returned in working order? If not, then I'd open it up and physically scrape a screwdriver acro

      • Uh, yeah. If you're in a high-security field such as medicine, defense contracting, or the like, you should not return hard drives that contain sensitive information. You should just suck it up and destroy the drive if you can't reliably wipe the data off of it.

      • by drerwk (695572)
        I bought a 2TB drive from NewEgg recently and made it my TimeMachine backup drive. After about a week it started unmounting randomly. Of course it had a full backup of everything on my main HD at that point. I was lucky that it mounted long enough for me to wipe the drive before I RMA'd it. I would have eaten the $200 rather than return it with my data on it. And I am thinking I might go to encrypting my backups at this point. But I never sell or give away old drives - I usually put a steal punch through th
      • Indeed. If an HDD fails, you should physically destroy it. Your data privacy is usually worth more than the disk.
        Obviously if the disk is faulty, you can't wipe it. Also, I think it's crazy buying a refurbished disk anyway - the annoyance of disk failure (even with raid) is usually greater than the price of the drive.

    • by PoochieReds (4973)

      You're assuming that the customer had the ability to wipe the drive after it failed. If it was defective then it's quite likely not to be the case.

      This sounds an awful lot like someone returned the drive either mistakenly thinking it was defective, or after hitting some sort of intermittent failure with it. NewEgg (or the HD vendor) then "tested" it and stuck it back on the shelf without wiping it. Or maybe they replaced some of the solid-state components and called it a day.

      Either way, I'd be very suspicio

      • Mod parent up. A good percentage of failed drives happens at the controller level. When a drive is refurbished, sometimes only the PCB controller board is swapped out leaving both the existing platters and data intact.

        With regards to data exposure. Who's at fault depends on where the drive originated from. For example, NewEgg gets a shipment of drives from WD or Seagate and then directly resells one to a customer. If it had data on it, that would be the fault of the drive manufacture. However if the drive w

  • The responsible thing to do is to make a TGZ of the contents and post it on Pirate bay. Zero the empty space to achieve the best compression, although someone might like rooting around in the raw data..

  • Who cares? (Score:5, Informative)

    by jdastrup (1075795) on Thursday February 09, 2012 @10:37AM (#38981903)
    Why bother? Ignore it. Dumb question. Move on.
    • Don't ignore it, get that OS license key!

    • What if it has kiddie porn, terrorist plans, etc?
    • by Lev13than (581686)

      Why bother? Ignore it. Dumb question. Move on.

      "I just received 3 'refurbished' Betamax VCRs from K-Mart. All 3 had some sort of existing cassette in the slot. Most appeared to be factory diagnostic patterns, but one had a recording of last month's Seinfeld episode and documentary on penguins. How big a deal is this? Should I contact someone besides K-Mart about this?"

  • Run a few times (>=2 ) the command:

    dd if=/dev/urandom /dev/sdx bs=4096

    The solution is a little bit harder if you don't run Linux: install it first.

    • by LoadWB (592248)

      dd exists for Windows, too. And Amiga. And Atari. I think there's even a CP/M version out there.

      • by idontgno (624372)
        Even simpler answer to that: livecd (or live usb) linux environment, rather than installing more stuff on your Windows or Amiga or Atari box.
    • by DogDude (805747)
      dd if=/dev/urandom /dev/sdx bs=4096 The solution is a little bit harder if you don't run Linux: install it first.

      And people say Linux is still hard to use....
  • by slaker (53818) on Thursday February 09, 2012 @10:38AM (#38981931)

    I've gotten drives I purchased as new from Amazon and Newegg with exsiting Windows installations on them. In fact, I'd say I see it maybe once in every 30 drives I get. I buy enough drives that I see six or seven such drives in a typical year. Once I got a drive that was clearly part of a Windows SoftRAID before I formatted it.

    Personally, I send those drives back. They clearly aren't new and they're not fit for sale in that state. I'm not paranoid enough to go looking at the SMART data for power on hours but when I run across drives like that it makes me think I should. Amazon will pay return shipping on drives in that condition. That is a good reason to buy drives from Amazon.

  • seat belt (Score:5, Informative)

    by pak9rabid (1011935) on Thursday February 09, 2012 @10:40AM (#38981963)
    I can't help but be reminded of this scene from the movie Old School:

    Mitch: Sorry, your seat belt seems to be broken. What do you recommend?
    Cab Driver: I recommend you stop being such a pussy. You're in the back seat.

    Just don't even worry about it. Nobody you complain to is really going to care. Give it a quick scan for anything interesting, and format once you're done.
    • by The Moof (859402)

      Just don't even worry about it. Nobody you complain to is really going to care.

      I don't know. I imagine if you look at the data, find out whose drive it was previously, and complain to them, they might care.

      They also might sue their drive recycling/refurbishment company if they're a business.

  • by King_TJ (85913) on Thursday February 09, 2012 @10:41AM (#38981989) Journal

    I'd ask if you can do an exchange for one with Windows 7 on it, since XP is getting pretty long in the tooth ....

    Seriously though, it sounds like NewEgg is usually putting the used drives through some sort of diagnostic process, if they all had special partitions on them for the purpose. Maybe they simply need to train their bench techs to wipe the drives first, instead of making the assumption that creating the new partition is ensuring any old data on the drive becomes unreadable/inaccessible?

  • There are some eastern european 'gentlemen' that will pay top dollar for quality information. Just extract the names and social security numbers, you can keep the drive.

    SD

  • Goodies (Score:5, Funny)

    by spooje (582773) <spoojeNO@SPAMhotmail.com> on Thursday February 09, 2012 @10:47AM (#38982111) Homepage
    First check for free porn, then call New Egg about it.
  • Happened to us once (Score:4, Interesting)

    by Gavin Scott (15916) on Thursday February 09, 2012 @10:49AM (#38982133)

    Quite a few years ago we bought an allegedly new drive from a bay area electronics retailer, and found it to contain some sort of raw partition containing a list of the names of approximately HALF THE PEOPLE in the United States along with some "number". Those of us who were listed in the data were unable to figure out what the number might be (an account number etc.)

    Eventually we got bored with the data and put the drive in service for its originally intended application.

    I wrote up the event and sent it off to the RISKS list, especially as Peter G. Neumann, the moderator of RISKS, was listed in the data, but they didn't publish it.

    G.

  • If it doesn't have the same diag partition, then NewEgg didn't do their usual refurb testing on it. Which means that there's a chance it's not in as good a shape as the others. So send it back and make them give you one that's been properly refurbed. There's no excuse for them not to have wiped the drive in the process of testing it before they resold it.

  • You don't need to write 0s or random data to disk, just format that sucker and start using it. Also, if you want, email New Egg to tell them about the problem. Maybe they'll forward the message onto the supplier who refurbishes drives and resells them without wiping the data first.
  • by davidwr (791652) on Thursday February 09, 2012 @10:53AM (#38982221) Homepage Journal

    I assume you don't have any LEGAL obligation to do anything other than not try to view the data. If you have any reason to suspect otherwise, ignore this entire Slashdot threat and call a lawyer.

    Now the question is, how much do you WANT do do, which boils down to "at least as much as your conscience requires" and "not so much work that you'll wish you'd never ordered the drive in the first place."

    At the low end of the stress scale, take an earlier poster's suggestion and use HDDErase or something similar followed by DBAN should make sure you don't ever stumble across their data. Sending it back to NewEgg accomplishes the same thing.

    If you send it back, I wouldn't use the normal return method. Instead, I'd write a letter to a high-level executive and include a copy of the drive-plate cover, a screen-shot, and a copy of your order along with a request that the executive do what it takes to make sure this never happens again, then ask for instructions to return the drive. Send the letter by certified mail. Keep copies of all correspondence.

    At the high end of the stress scale, you can probably complain to a government agency, as NewEgg may have violated the law.

    There are other options in between.

  • by zwei2stein (782480) on Thursday February 09, 2012 @10:56AM (#38982271) Homepage

    Order more drives. Hope for jackpot.

  • Contact the original owner, and extort them for $50k. It worked so well for Anonymous and Symantec.

  • Only you know how much you care, so only you know how far to go to do something about it. If it were me, I'd look at the files to see if there was something interesting then go from there. Otherwise DBAN and deal with it.

  • If the hard drive was sold as new and had somebody's data on it, that's a strong case against Newegg.

    But this is a used hard drive, and it's not Newegg's responsibility to wipe it unless they're advertising that it's been wiped. Newegg's responsibility is just to test it to see that it works (and fix it if necessary) before selling it as refurbished. Wiping the data is the responsibility of the previous owner of the hard drive.

    Having said that, it would be a good idea for them to at least do a quickformat

  • by Gumbercules!! (1158841) on Thursday February 09, 2012 @11:36AM (#38982859)
    I once had to wipe some disks before throwing them out (nothing really sensitive or important). But they were SCSI and I didn't have a SCSI enabled PC handy and I couldn't be bothered setting something up or downing a server to do it, etc.

    So I came up with a technique for making the disks safe for disposal.

    First, I threw them out the 2nd story window a few times. Then I hurled them at the ground a few more times as hard as I could for good measure.

    Then I put them in a plastic bag with a heap of dog shit and water, tied the bag up and put them in the bin. If anyone still wanted to try to retrieve that data, they've earned it.

    True Story. Still makes me smile.

Stinginess with privileges is kindness in disguise. -- Guide to VAX/VMS Security, Sep. 1984

Working...