Link This | Email this | Blog This | Comments (0)

20th vs. 21st century sleuthing
October 21, 2006

The latest scandal to hit high-tech industry employed some decidedly low-tech operations. Gumshoes seemingly out of bad 20th century crime novels sorted through trash and impersonated the targets of their investigations to ferret out private information like phone records. About the only 21st century innovation seems to be the substitution of the new word “pretexting” for the traditional “lying.” Wall Street Journal reporter Pui-Wing Tam writes about being the subject of these tactics here (subscription required), where she notes that she was also the subject of “pre-trash inspection”—a term whose definition seems elusive.

But it turns out there’s a higher tech way of getting phone records, or at least records from phones. The Washington Post reports today that commercially available software can resurrect erased data on cell phones, including address books, calendar, photos, videos and e-mails, “turning used phones into a treasure trove for identity thieves and allowing them in effect to buy personal data off the Internet.” The article quotes Amber Schroader, chief executive of Paraben, a forensic software firm that helps law-enforcement agents extract smart-phone data: "It is amazing how a couple of megabytes of data on a cell phone can reveal so much about you--the last place you were, the last person you talked to."

The article notes that data-security company Trust Digital bought 10 used smart phones on eBay and was able to retrieve “one company's plans to win a multimillion-dollar federal transportation contract, e-mails about another firm's $50,000 payment for a software license, bank accounts and passwords, medical prescriptions, and receipts for utility payments” as well as text messages between paramours.

Such data remains available to sleuths because when a user erases a file or record, the data isn’t cleared from flash memory (just as deleting a computer file doesn’t remove the data from disk). Only the pointers to it are removed. The data itself disappears only when—and if—it’s overwritten.

The Website www.Wirelessrecycling.com, which would like you to donate your old phone to charity instead of selling it on eBay, provides more information on permanently erasing data.

Posted by Rick Nelson on October 21, 2006 | Comments (0)