Ministry of Privacy

Trip down memory lane

0. Summary

Browse second-hand sites like marktplaats.nl or Vinted and you’ll find plenty of people selling their old memory devices: USB sticks and hard drives. It always fascinated me: how confident are these sellers that their personal data is really gone from the device? I decided to find out. I bought used USB sticks and hard drives and ran recovery software on them. What followed was an adventure that took me to places that still make my stomach hurt: photos of valid passports, saved passwords, medical records, nudes, and banking details.

A note before you read further.

This project involved recovering data from second-hand USB drives and hard drives bought from private sellers and companies. Some of what turned up was highly sensitive: photographs of valid passports, medical information, banking details, intimate images, and login credentials.

I want to be upfront about how this was handled, because it matters:

This is not a guide to recovering other people’s data, and it isn’t an invitation to buy discarded drives and go looking through them. The point is the opposite: to show, with real numbers, that deleting your files is not the same as removing your data, so that people take one extra step before selling, donating, or throwing out a storage device.

I am not a computer expert, a lawyer, or a privacy professional, just someone who got curious, did the reading, and tried to act responsibly with what turned up. Please don’t take anything on this site as authoritative advice; I just did my best. Work on this project started around February 2024 and happened in bursts rather than continuously, and I’ve tried to keep the story of it readable and relevant rather than exhaustive, a lot has been left out to keep it that way. I also relied on Google, ChatGPT en Claude to help write and improve code and tools along the way. My goal throughout was simply to give a clear, honest picture of the steps I took, in a way that others can follow and, if they want to, reproduce what I did.

1. Introduction

It started with a YouTube video on recovering files from a USB drive. I tried it on one of my own drives and was startled by how easy it was. Around the same time, I noticed people selling old USB drives on marktplaats.nl and got curious: had they actually wiped them? Could the files still be recovered? I bought a few to find out, and that was the start of the rabbit hole. I ended up working with a total of 80 USB drives and hard drives.

The design of the project

I’ll go into detail later, but here’s an overview of the steps I took.

  1. Buying the devices. I bought devices from people selling them on second-hand sites like marktplaats.nl and Vinted.
  2. Making a copy of the devices. Scanning a device directly can take a long time, especially for USB drives, so I found it much faster to image each device first and scan the image instead. I bought an external hard drive to store the images and extracted files.
  3. Extracting information from the image. I checked each image for files that hadn’t been deleted, and used recovery software to check whether deleted files could still be pulled out. Anything the recovery software found went into a separate folder on the external drive.
  4. Analysing the extracted information. I looked through the recovered files, documented what I found, and then deleted the files.

Privacy

After scanning the first few USB drives and finding personal information on them, I realized I needed a real plan for protecting the privacy of the people whose data this was. I approached that in five ways: pseudonymization, minimal collection, access control, proportional analysis, and minimal retention.

Pseudonymization. I took steps to make it harder to link a USB drive or hard drive, and the data on it, back to the seller. This matters because the more a piece of data can be tied to an identifiable seller, the greater the privacy risk. I did this in three ways:

Gathering as little as possible. An easy way to protect privacy is to simply collect less data. So I only looked for the information most likely to answer my actual question (whether personal data was still recoverable) and limited myself to office documents, media files, and ZIP archives.

Access control. I also controlled who had access to the data I collected:

Proportional analysis. Recovered files were analysed only to the extent needed to answer the research question. Files were opened just far enough to check whether they were corrupt and to judge whether they likely contained personal information. If, for example, a scanned image showed a bank’s letterhead, I assumed it contained personal information without reading the letter itself. Where documents contained credentials (usernames and passwords), I never tested whether they still worked.

Minimal retention. At every stage, I removed the data from the step before it: once a USB drive was imaged, the drive itself was wiped; once an image had been analysed, the image was deleted; and so on. This supports both access control (less data around to protect) and pseudonymization (harder to trace data back to a seller). Once the extracted information had been analysed and documented, I also wiped the external hard drive that had held the images and recovered files.

2. Buying the drives

I bought all the drives through online second-hand marketplaces. I also tried thrift shops but never found any there. I wasn’t picky: if a drive looked used and the price was reasonable, I messaged the seller. Sometimes they sold just one drive, sometimes several. USB drives came only from private sellers; hard drives from both private sellers and companies. I’d meant to keep a careful log of what I paid, exact sizes, and so on. But that’s just not who I am, especially not across a project spanning two and a half years. So here is information about the drives

Over the following months, drives kept arriving in the mail. I opened all the packages at once and dumped them into a plastic container, to mixed them together.

3. Making a copy of the drives

I started out using the program Foremost directly on each USB drive, one at a time. Scanning took a long time this way, especially with older drives. So I switched to imaging each drive onto an external hard disk first and scanning the image instead, which sped things up considerably.

At first I used dd to make the copy, then hashed both the image and the original drive to confirm they matched exactly. The drawback was that hashing a drive took just as long as copying it. Through dcfldd I came across ddrescue, which has better strategies for reading damaged drives. At that point I shifted from forensic double-checking toward simply getting as much data as possible off each drive. I used the following command:

ddrescue -S "$STICK" "$IMAGE" "${GEVONDEN}/mapfile.log"

4. Extracting information from the copy

The goal here was to see how well each drive had actually been wiped. First, I checked whether the image still held ordinary, non-deleted files by mounting the .dd file and looking inside.

To recover deleted files, I tried three tools: Foremost, PhotoRec, and Scalpel. I never got Scalpel working properly: far too many false positives; the combined size of the files it “recovered” often exceeded the size of the image itself. I liked Foremost from the start: fast and clean. But once I tried PhotoRec, it consistently found more files than Foremost did, so I switched to it.

How do recovery tools actually work? Tools like PhotoRec scan a disk or image byte by byte, looking for the signature that marks the start of a known file type. A PDF, for instance, always begins with “%PDF”, and a ZIP file with “PK”. Once a starting point is found, the tool looks for the corresponding end and saves everything in between as a file. This works, but not always: if a file is fragmented across the disk, or partly overwritten, the result is a corrupted file that won’t open. There are also false positives, where a random sequence of bytes just happens to resemble a file header.

Recovering files (checking for existing files, extracting deleted ones, logging the results) takes a lot of hands-on time. I did most of it while doing other things, laptop and a bin of unscanned drives beside me. To save time and keep the method consistent across every drive, I wrote a script: plug in the drive, enter a unique ID and the drive’s path, and it handled the rest. This is the core scan command it ran:

photorec /log /d "$PHOTOREC_OUT" /cmd "$IMAGE" fileopt,everything,disable,zip,jpg,png,pdf,doc,kdb,kdbx,rlv,key,pfx,txt,mpg,mp3,search

What this does:

This left every drive with its own folder: log files, plus a set of recovered files. Here you can see what that looked like from the console, I added “->” and explanation: 

$ tree 14_20260422_084102
14_20260422_084102
├── 14_20260422_084102.log -> my log file
├── mapfile.log -> PhotoRec logfile
├── mapfile.log.bak -> PhotoRec makes a backup of it's logfile
├── photorec -> Empty folder, not sure why
└── photorec.1 -> Folder containing extracted files
  ├── f0038624.docx -> extracted file
  ├── f0038704.pptx -> extracted file
  ├── f0038768.pdf -> extracted file
  ├── f0038784.pdf -> extracted file
  └── report.xml -> report PhotoRec made

3 directories, 8 files

5. Analyzing the extracted information

Here are the number of devices where I could extract information from, the files I found and what they contained.

The memory devices

10 devices still contained files that had not been removed. From the 64 USB drives that I could image and scan, I recovered files from 54 of them, so 84% had recoverable files on them. From the 16 hard drives I could extract files of 7 of them, 44%. On average 76% of the devices I tried contained files I could extract.

The file types I found

One nice feature of Foremost is that it outputs a summary of what it found. Unfortunately, I’d already switched to PhotoRec, which doesn’t do this by default. So once extraction was done, I ran the following on the folder holding all the extracted files, to get a breakdown of file types:

find . -type f | sed -n 's/.*\.\([a-zA-Z0-9]*\)$/\1/p' | sort | tr '[:upper:]' '[:lower:]' | sort | uniq -c | sort -rn

Here is what I found:

How many  file type
 337084   txt
 301979   jpg
 72563   png
 18102   doc
 14459   mpg
 14111   mp3
  9605   h
  6544   java
  6416   html
  4018   docx
  3722   epub
  2928   pdf
  2647   ini
  2094   zip
  1354   xls
  1017   jsp
  997   py
  923   f
  627   c
  590   xlsx
  567   vcf
  539   jar
  450   csv
  209   ppt
  159   log
  150   pptx
  141   db
  118   bat
   78   xml
   64   ods
   55   sxw
   50   bak
   35   odt
   29   inf
   20   vsd
   16   json
   13   msg
   13   ai
   12   xlr
   11   pfx
   7   php
   6   kdb
   3   xpi
   3   pub
   3   asp
   2   kmz
   1   tif
   1   tex
   1   pl
   1   ldif
   1   go
   1   dat
   1   albm

I was fairly sure I’d limited PhotoRec to a specific list of file types, so I’m not sure how the others in the results ended up there.

The contents

Not every recovered file was actually usable. Some were only partial, or corrupted, which is an inherent limitation of this extraction method. How many were corrupted varied a lot by file type. My method for judging corruption was simple: try to open the file. I also noticed that files with names a person would plausibly have given them (diary.docx, for example) were far less likely to be corrupt.

I’d originally planned to track exact corruption rates per file extension. The thing about a project like this is that you learn things about yourself, and what I learned is that I’m not that kind of person. So estimates will have to do. Most JPGs and PNGs opened fine; for Word documents and ZIP files, only around 10–15% were accessible. Text files where pure chaos, ranging from parts of websites, XML, logfiles and even what looks like hexa decimal information. From one hard drive, PhotoRec extracted 196030 text files. So the raw number of files recovered doesn’t translate 1:1 into usable data. Worth noting too: a share of the recovered images were thumbnails, so the number of genuinely unique images is lower than the raw file count suggests.

Of the files I could open, only some contained personal information. When a drive yielded just a handful of files, I checked all of them; when it yielded many, I opened files at random until I felt I had a representative picture. I initially set up a scale for how sensitive the content was (not personal, mildly personal, sensitive personal data (GDPR Article 9), and credentials) but in practice I ended up simply working through the files and noting a short description whenever something new turned up.

I’ve put together a summary of what I found. It isn’t exhaustive, and it doesn’t claim to be complete, but it gives a real sense of the kind of information that turns up.

Potential implications

To make this project land as more than an abstract statistic, I wanted to connect the results to everyday risk. A few scenarios I came up with:

Many more scenarios are possible beyond this list.

6. Conclusions

This project set out to answer one question: when people sell their USB drives or hard drives, have they actually removed their personal data? The answer is no. 76% of the devices I examined still contained recoverable information, some of it highly personal. [X]% still had non-deleted files sitting on them in plain sight.

This doesn’t just show that data gets left behind, it shows that data can cause real harm. From some early digging, I have the idea that properly wiping a USB drive is impossible, because of how flash storage handles wear-levelling internally (provisioning). Wiping a hard drive is possible, but reliable only at the firmware level, and hard to verify afterwards.

Solutions

For now, I see two real options: never let the drive leave your hands, or encrypt it. The first option isn’t complicated: don’t sell or lend the device. When you’re done with it, destroy it. For USB drives, simply snapping off the connector should be enough to stop anyone with home equipment from pulling data off it. For hard drives, remove the circuit board and dispose of it separately. It’s a small price to pay, USB drives aren’t worth much these days, and unless you’re a computer specialist, the hard drive you’re selling is probably old and small enough that it wouldn’t have sold for much anyway. If you are a computer specialist (and potentiall sell larger memory devices), you absolutely should be using the second option.

The best option is to use encryption. Encrypt your storage devices from the day you start using them, and you won’t need to wipe anything before selling. Without the password, nobody can read what’s on it. And as a bonus, whenever your device is lost or stolen, your data is protected. Just don’t forget to turn encryption on as soon as you get the drive, before storing anything on it.

Reflections

This project ran over roughly two and a half years. I worked on whenever I had the time and the inclination. I started by experimenting on my own old devices, and recovering files from years back gave me a real rush, reliving old memories. But recovering files from drives I’d bought felt different. Every single time, it made me sad. So many people, vulnerable without realizing it. The feeling that people should be protected was what kept me going, and what convinced me to tell the world about it.

Future research

Nothing is ever really finished. These are questions I ran into along the way but didn’t have the time, money, knowledge, or motivation to chase down for now:

Thank you for making it to the end. Have thoughts about this? I got lot more information, is there something you would like to know? Drop me a line: hello@ministerievanprivacy.nl