At the HCI 2010 conference in Dundee, Scotland, researchers from Glasgow University announced preliminary results that show that a high number of re-sold mobile phones contain personal information left by previous owners. In some cases the data was highly sensitive or incriminating – and in some cases was believed deleted, but still recoverable.The researchers – Storer, Glisson and Grispos – obtained second-hand phones and mobile devices from eBay and pawn shops and used digital forensics techniques to carefully examine and recover data from the phones. This data was then analysed to see if it contained personal aspects (such as domestic arrangements or private correspondence) or sensitive aspects (information that the owner would likely not wish to share with others). Here are some of their results:

From just 45 phones, they recovered over 7,000 pieces of data including nearly 2,000 images and around 2,700 SMS messages. Over 1,000 pieces of data were personal in nature and over 200 were highly sensitive (including nudity, drug use, pornography, bank account details, health information and explicit material about other contacts on the phone).

Alarmingly, of these 7,000 items 1/7th were “deleted” – their users likely believed them safely destroyed. The team observed that mobile phone operating systems do not give users the ability to completely destroy the data (unlike hard drives which can be reformatted without third-party software). They found that 20% of detectable deleted data could be recovered, and also observed that older phones were considerably worse at securely deleting data, compared to smartphones.

The research, which is still ongoing, is described in this preliminary paper (PDF). In future work they plan to compare different digital forensic techniques and look at the effectiveness of “phone scrubbers”.

As we record and perform more and more of our lives digitally, data housekeeping is just one more skill we will need to learn if we want to maintain our privacy.