A Digital Forensic Investigation of the Presence of Personally Identifiable Information (PII) in Refurbished Hard Drives

The last decade has seen a massive explosion of data, with a lot of Personally Identifiable Information (PII) flooding devices and the cyberspace. This has necessitated the growing call and global awareness for data protection, to ensure the responsible use of data, protect the privacy of data subjects, and prevent crimes such as identity theft and cybercrime. This paper investigated the presence of residual data and Personally Identifiable Information (PII) in refurbished hard drives bought from a retail shop. The study leveraged digital forensic tools to perform data recovery on refurbished hard drives, and analyses for presence of PII. The study adopted a modified form of the steps in Digital Investigation outlined by NIST IR 8354. Result of this study showed that one out of the 3 hard drives that were reportedly formatted and sanitized by the vendors had residual data with PII. Data recovered includes 28691 files with size on disk as 152.20GB, including PII and sensitive data. Digital Forensic tools used for this study includes EaseUS Data Recovery Wizard and Autopsy. The findings of this study are quite relevant to current studies in privacy and data protection, including recent legislations such as Nigeria Data Protection Act (NDPA), General Data Protection Regulation (GDPR), and others. The paper also presents a comprehensive and forensically sound software-based methodology focused on the recovery of deleted data from hard drives.