Schneier on Security

A blog covering security and security technology.

« Scorecard from the War on Terror | Main | Securing Wireless Networks with Stickers »

September 5, 2006

Recovering Data from Cell Phones

People sell, give away, and throw away their cell phones without even thinking about the data still on them:

A company, Trust Digital of McLean, Virginia, bought 10 different phones on eBay this summer to test phone-security tools it sells for businesses. The phones all were fairly sophisticated models capable of working with corporate e-mail systems.

Curious software experts at Trust Digital resurrected information on nearly all the used phones, including the racy exchanges between guarded lovers.

The other phones contained:

• One company's plans to win a multimillion-dollar federal transportation contract.

• E-mails about another firm's $50,000 payment for a software license.

• Bank accounts and passwords.

• Details of prescriptions and receipts for one worker's utility payments.

The recovered information was equal to 27,000 pages -- a stack of printouts 8 feet high.

"We found just a mountain of personal and corporate data," said Nick Magliato, Trust Digital's chief executive.

In many cases, this was data that the owners erased.

A popular practice among sellers, resetting the phone, often means sensitive information appears to have been erased. But it can be resurrected using specialized yet inexpensive software found on the Internet.

More and more, our data is not really under our control. We store it on devices and third-party websites, or on our own computer. We try to erase it, but we really can't. We try to control its dissemination, but it's harder and harder.

Posted on September 5, 2006 at 9:38 AM • View Blog Reactions

To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.