Analysis of Information Remaining on Hand Held Devices Offered for Sale on the Second Hand

The ownership and use of mobile phones, Personal Digital Assistants and other hand held devices is now ubiquitous both for home and business use. The majority of these devices have a high initial cost, a relatively short period before they become obsolescent and a relatively low second hand value. As a result of this, when the devices are replaced, there are indications that they tend to be discarded. As technology has continued to develop, it has led to an increasing diversity in the number and type of devices that are available, and the processing power and the storage capacity of the digital storage in the device. All organisations, whether in the public or private sector increasingly use hand held devices that contain digital media for the storage of information relating to their business, their employees or their customers. Similarly, individual private users increasingly use hand held devices containing digital media for the storage of information relating to their private lives. The research revealed that a significant number of organisations and private users are ignorant or misinformed about the volume and type of information that is stored on the hand held devices and the media on which it is stored. It is apparent that they have either not considered, or are unaware of, the potential impact of this information becoming available to their competitors or those with criminal intent. This main purpose of this study was to gain an understanding of the volume and type of information that may remain on hand held devices that are offered for sale on the second hand market. A second aim of the research was to determine the level of damage that could, potentially be caused, if the information that remains on the devices fell into the wrong hands. The study examined a number of hand held devices that had been obtained from sources in the UK and Australia that ranged from internet auction sites, to private sales and commercial resellers. The study was carried out by the security research team at the BT IT Futures Centre in conjunction with Edith Cowan University in Australia and the University of Glamorgan in the UK. The basis of the research was to acquire a number of second hand hand held devices from a diverse range of sources and then determine whether they still contained information relating to a previous owner or whether the information had been effectively removed. The devices that were obtained for the research were supplied blind to the researchers through a third party. The ‘blind’ supply of the devices meant that the people undertaking the research were provided with no information about the device and that the source of the devices and any external markings were hidden from them. This process was put in place to ensure that any findings of the research were based solely on the information that could be recovered from the digital storage media that was contained within the device. The underlying methodology that was used in the research was based on the forensic imaging of the devices. A forensic image of a device is a copy of the digital media that has been created in a scientifically sound manner to a standard that is acceptable to the courts. This procedure was implemented to ensure that the evidential integrity of the devices was maintained, with the devices also then being stored in a secure manner. All subsequent research was then conducted on the image of the device. This was considered to be a sensible precaution against the possibility that information discovered on a device might indicate criminal activity and require the involvement of law enforcement. Following the forensic imaging of the devices, the images that were created were then analysed to determine whether any information remained and whether it could be easily recovered using commonly available tools and techniques that anyone who had purchased the device could acquire

The 2006 Analysis of Information Remaining on Disks Offered for Sale on the Second Hand Market

All organisations, whether in the public or private sector, use computers for the storage and processing of information relating to their business or services, their employees and their customers. A large proportion of families and individuals in their homes now also use personal computers and, both intentionally and inadvertently, often store on those computers personal information. It is clear that most organisations and individuals continue to be unaware of the information that may be stored on the hard disks that the computers contain, and have not considered what may happen to the information after the disposal of the equipment. In 2005, joint research was carried out by the University of Glamorgan in Wales and Edith Cowan University in Australia to determine whether second hand computer disks that were purchased from a number of sources still contained any information or whether the information had been effectively erased. The research revealed that, for the majority of the disks that were examined, the information had not been effectively removed and as a result, both organisations and individuals were potentially exposed to a range of potential crimes. It is worthy of note that in the disposal of this equipment, the organisations involved had failed to meet their statutory, regulatory and legal obligations. This paper describes a second research project that was carried out in 2006 which repeated the research carried out the previous year and also extended the scope of the research to include additional countries. The methodology used was the same as that in the previous year and the disks that were used for the research were again supplied blind by a third party. The research involved the forensic imaging of the disks which was followed by an analysis of the disks to determine what information remained and whether it could be easily recovered using publicly available tools and techniques

The 2007 Analysis of Information Remaining on Disks Offered for Sale on the Second Hand Market

All organisations, whether in the public or private sector, increasingly use computers and other devices that contain computer hard disks for the storage and processing of information relating to their business, their employees or their customers. Individual home users also increasingly use computers and other devices containing computer hard disks for the storage and processing of information relating to their private, personal affairs. It continues to be clear that the majority of organisations and individual home users still remain ignorant or misinformed of the volume and type of information that is stored on the hard disks that these devices contain and have not considered, or are unaware of, the potential impact of this information becoming available to their competitors or to people with criminal intent. This is the third study in an ongoing research effort that is being conducted into the volume and type of information that remains on computer hard disks offered for sale on the second hand market. The purpose of the research has been to gain an understanding of the information that remains on the disk and to determine the level of damage that could, potentially be caused, if the information fell into the wrong hands. The study examines disks that have been obtained in a number of countries to determine whether there is any detectable national or regional variance in the way that the disposal of computer disks is addressed and to compare the results for any other detectable regional or temporal trends. The first study was carried out in 2005 and was repeated in 2006 with the scope extended to include additional countries. The studies were carried out by British Telecommunications, the University of Glamorgan in the UK and Edith Cowan University in Australia. The basis of the research was to acquire a number of second hand computer disks from various sources and then determine whether they still contained information relating to a previous owner or if information had been effectively erased. If they still contained information, the research examined whether it was in a sufficient volume and of enough sensitivity to the original owner to be of value to either a competitor or a criminal. One of the results of the research was that, for a very large proportion of the disks that were examined, there was significant information present and both organisations and individuals were potentially exposed to the possibility of a compromise of sensitive information and identity theft. The report noted that where the disks had originally been owned by organisations, they had, in most cases, failed to meet their statutory, regulatory and legal obligations. In the third and latest study, conducted in 2007, the research methodology of the previous two studies conducted was repeated, but in addition to Longwood University in the USA joining the research effort, the scope was broadened geographically and the focus was extended to determine what changes had occurred in the availability of sensitive information might be occurring over time

Zombie Hard disks - Data from the Living Dead

There have been a number of studies conducted in relation to data remaining on disks purchased on the second hand market. A large number of these studies have indicated that a proportion of these disks contain a degree of residual data placed on the drive by the original owners. The Security Research Centre at BT has sponsored a residual data study over the last five years examining disks sourced around the globe, in the UK, USA, Germany France and Australia. In 2008 as part of a 5 year study, Glamorgan University in conjunction with Edith Cowan University in Australia, Longwood University in Virginia USA and the BT Security Research Centre completed the fourth annual disk study aimed at assessing the volume and nature of information that remains on computer hard disks offered for sale on the second hand market. One of the main findings of the study was the high proportion of disks that are sold in a non-functioning state. As in both previous and following years a percentage of the hard disks examined in the 2008 study failed the imaging process and were marked as faulty. This paper describes further analysis of a number of these faulty drives from the UK sample set of the 2008 study. This paper details the analysis of non-functioning disks supplied to the University of Glamorgan to determine the ease with which data can be recovered from these drives using specialist recovery tools. It discusses implications for both computer forensics and information security practices and procedures

A forensic overview of the LG Smart TV

The emerging Smart TV platform will likely replace traditional television sets over time as the entertainment and communication centrepiece in people’s homes. Given its expanded functionality and now, its online presence, there is a need to identify how they may become part of forensic investigations. The purpose of this paper is to introduce the area of Smart TVs and the potential forensic value these systems present in combination with their ever advancing functionality and capabilities. We provide an overview of Smart TV systems highlighting functionality and potential issues. We also take an initial look at two particular models, from the same manufacturer, to highlight the different range of material that may be available to the forensic examiner and provide an outline to investigators of the steps necessary to ensure relevant forensic data can be captured for processing, as part of an investigation. We then discuss the need for future work to improve access for forensic investigators

The 2009 Analysis of Information Remaining on Disks Offered for Sale on the Second Hand Market

The ever increasing use and reliance upon computers in both the public and private sector has led to enormous numbers of computers being disposed of at the end of their useful life within an organisation. As the cost of computers has dropped, their use in the home has also continued to increase. In most organisations, computers have a relatively short life and are replaced on a regular basis with the result that, if not properly cleansed of data, they are released into the public domain containing data that can be relatively up to date. This problem is exacerbated by the increasing popularity and use of smart phones, which also contain significant storage capacity. From the results of the research it remains clear that the majority of organisations and private individuals that are using these computers still remain ignorant or misinformed of the potential volume and type of information that is stored on the hard disks contained within these systems. The evidence of the research is that neither organisations nor individuals have considered, or are aware of, the potential impact of the information that is contained in the disks from these systems becoming available to an unintended third party. This is the fifth study in an ongoing research programme being conducted into the levels and types of information that remain on computer hard disks that have been offered for sale on the second hand market. This ongoing research series has been undertaken to gain an understanding of the level and types of information that remains on these disks, to determine the damage that could potentially be caused if the information was misused, and to determine whether there are any developing trends. The disks used have been purchased in a number of countries. The rationale for this was to determine whether there are any national or regional differences in the way that computer disks are disposed of and to compare the results for any regional or temporal trends. The disks were obtained from a wide range of sources in each of the regions in order to minimise the effect of any action by an individual source. The first study was carried out in 2005 and since then has been repeated annually with the scope being incrementally extended to include additional research partners and countries. The study in 2009 was carried out by British Telecommunications (BT) and the University of Glamorgan in the UK, Edith Cowan University in Australia, Khalifa University in the United Arab Emirates and Longwood University in the USA. The core methodology of the research has remained unaltered throughout the duration of the study. The methodology has included the acquisition of a number of second hand computer disks from a range of sources and determining whether the data contained on the disks has been effectively erased or if they still contain information relating to previous owners. If information was found on the disks from which the previous user or owner could be identified, the research examined whether it was of a sensitive nature or in a sufficient volume to represent a risk. One of the consistent results of the research through the entire period has been that, for a significant proportion of the disks that have been examined, there was sufficient information present to pose a risk of a compromise of sensitive information to either the organisation or the individual that had previously used the disks. The potential impacts of the exposure of this information could include embarrassment to individuals and organisations, fraud, blackmail and identity theft. In every year since the study started, criminal activity has also been exposed. As has been stated in the previous reports, where the disks had originated from organisations, they had, in many cases, failed to meet their statutory, regulatory and legal obligations

A highly emissive inorganic hexamolybdenum cluster complex as a handy precursor for the preparation of new luminescent materials

The synthesis and characterisation of a new, highly luminescent inorganic cluster complex, (Bu4N)2[Mo6I 8(NO3)6], are described. The complex possesses labile nitrato ligands and is therefore a useful precursor for the design of new luminescent materials. To exemplify this, functionalised polystyrene beads have been utilised as "polymeric ligands" to immobilise the molybdenum cluster complex. This journal i

Polymeric microspheres as protein transduction reagents

Discovering the function of an unknown protein, particularly one with neither structural nor functional correlates, is a daunting task. Interaction analyses determine binding partners, whereas DNA transfection, either transient or stable, leads to intracellular expression, though not necessarily at physiologically relevant levels. In theory, direct intracellular protein delivery (protein transduction) provides a conceptually simpler alternative, but in practice the approach is problematic. Domains such as HIV TAT protein are valuable, but their effectiveness is protein specific. Similarly, the delivery of intact proteins via endocytic pathways (e.g. using liposomes) is problematic for functional analysis because of the potential for protein degradation in the endosomes/lysosomes. Consequently, recent reports that microspheres can deliver bio-cargoes into cells via a non-endocytic, energy-independent pathway offer an exciting and promising alternative for in vitro delivery of functional protein. In order for such promise to be fully exploited, microspheres are required that (i) are stably linked to proteins, (ii) can deliver those proteins with good efficiency, (iii) release functional protein once inside the cells, and (iv) permit concomitant tracking. Herein, we report the application of microspheres to successfully address all of these criteria simultaneously, for the first time. After cellular uptake, protein release was autocatalyzed by the reducing cytoplasmic environment. Outside of cells, the covalent microsphere-protein linkage was stable for ≥90 h at 37°C. Using conservative methods of estimation, 74.3% ± 5.6% of cells were shown to take up these microspheres after 24 h of incubation, with the whole process of delivery and intracellular protein release occurring within 36 h. Intended for in vitro functional protein research, this approach will enable study of the consequences of protein delivery at physiologically relevant levels, without recourse to nucleic acids, and offers a useful alternative to commercial protein transfection reagents such as Chariot™. We also provide clear immunostaining evidence to resolve residual controversy surrounding FACS-based assessment of microsphere uptake

Density and Velocity Fields from the PSCz Survey

We present the results for the predicted density and peculiar velocity fields and the dipole from the PSCz survey of 15,000 IRAS galaxies over 84% of the sky. We find a significant component to the dipole arising between 6000 and 15,000 km/s, but no significant component from greater distances. The misalignment with the CMB is 20 degrees. The most remarkable feature of the PSCz model velocity field is a coherent large-scale flow along the baseline connecting Perseus-Pisces, the Local Supercluster, Great Attractor and the Shapley Concentration. We have measured the parameter beta using the amplitude of the dipole, bulk flow and point by point comparisons between the individual velocities of galaxies in the MarkIII and SFI datasets, and the large-scale clustering distortion in redshift space.All our results are consistent with beta = 0.6 +- 0.1.Comment: 8 pages, 8 figures. To appear in 'Towards an Understanding of Cosmic Flows', Victoria, July 1999, eds Courteau,S., Strauss,M., Willick,J. PAS

Unravelling the immune signature of Plasmodium falciparum transmission-reducing immunity

Infection with Plasmodium can elicit antibodies that inhibit parasite survival in the mosquito, when they are ingested in an infectious blood meal. Here, we determine the transmission-reducing activity (TRA) of naturally acquired antibodies from 648 malaria-exposed individuals using lab-based mosquito-feeding assays. Transmission inhibition is significantly associated with antibody responses to Pfs48/45, Pfs230, and to 43 novel gametocyte proteins assessed by protein microarray. In field-based mosquito-feeding assays the likelihood and rate of mosquito infection are significantly lower for individuals reactive to Pfs48/45, Pfs230 or to combinations of the novel TRA-associated proteins. We also show that naturally acquired purified antibodies against key transmission-blocking epitopes of Pfs48/45 and Pfs230 are mechanistically involved in TRA, whereas sera depleted of these antibodies retain high-level, complement-independent TRA. Our analysis demonstrates that host antibody responses to gametocyte proteins are associated with reduced malaria transmission efficiency from humans to mosquitoes