T 3.93 Incorrect handling of defective data media
All types of data media can fail, become damaged, or contain errors in the data. Documents can become smeared or torn, CDs can have bit errors, or a hard drive crash can occur. Inexpensive data media in particular are often thrown away immediately in this case and replaced by new data media. More expensive data media are sent in for repair. However, care must be taken in both cases because it will still be possible under certain circumstances to reconstruct the information stored on the data media, even if they were almost completely destroyed. Professional data recovery companies can even make the data on fire-damaged hard disks readable again using appropriate equipment. For this reason, it must be assumed that it is possible to read and process confidential data when disposing of defective data media or when taking operable data media out of service.
Examples:
- In one company, the laptop of the managing director would not boot up any more. Since the guarantee was still valid when it happened, the laptop was sent to the manufacturer. After completing repairs, the laptop was sent back by mail, but the company never received it. Not only were time-critical project plans stored on the laptop, but personal data and sensitive internal information was stored on the laptop as well.
- A government agency collected all the CDs to be disposed of over a long period of time and gave them to a charitable organisation for a good cause. The organisation used the CDs for handicrafts and other similar purposes, among others. Numerous advertising CDs were among the donated CDs, but CDs containing data backups were also among them. Later on, CDs were found decorating the Christmas trees in the city centre, and under the colourful Christmas images on the CDs it was possible to read the label "Personnel Files A-D, Company ABC, Confidential". Since the reflective data side of the CDs was not handled in any way, it was possible to read this data without any problem in some cases.