What scavenging is
Scavenging is the search through leftover data for sensitive information that was never properly erased. The target is not a system under attack but the residue of past work: discarded drives, temporary files, old backups, and copies left in shared folders. Nothing is broken into, so the technique looks like ordinary browsing.
The residue itself is called data remanence. Deleting a file usually removes only its reference, so the content can survive on the disk until the space is reused. That gap is what makes scavenging possible.
Where residual data accumulates
Sensitive information rarely exists in exactly one place. Long after a document is considered gone, fragments and copies survive in locations nobody thinks to govern, including stale data in old folders:
| Source | What stays behind |
|---|---|
| Physical waste and discarded media | Printed reports, sticky notes with passwords, drives thrown out unerased |
| Temporary files and caches | Working copies, autosave files, print spools, browser caches |
| Deleted files | Content stays on disk until overwritten, recoverable with standard tools |
| Shared folders and misconfigured storage | Working copies visible to far more people than intended |
| Retired equipment | Workstations, servers, phones, and copiers that keep their stored data |
| Old backups and snapshots | Data kept long after the live copy was corrected or deleted |
Physical vs. digital scavenging
The classic image is someone searching a dumpster behind an office, hence the term dumpster diving. Printouts, discarded hardware, and sticky notes with passwords have caused real incidents for decades, and the technique needs no technical skill.
The digital variant works the same way at a larger scale. A curious employee browses an open network share, mounts a secondhand disk, or inspects a repurposed laptop for configuration files and exported databases. Because nothing is hacked, no alarm goes off, and the activity can stay unnoticed for years.
What it looks like in Anexet
In Anexet DLP, the network share audit records file operations and can keep a shadow copy of what is written to a share. The File Systems Monitoring uses hash matching to find copies of protected documents on workstations.
1 / 2
Who scavenges, and why
For an external attacker, scavenging is cheap reconnaissance: a discarded org chart, an old configuration file, or a note with credentials saves days of probing. For a malicious insider, such as an employee about to leave, it is a deniable way to collect data, because nothing travels through monitored channels.
Researchers and journalists have repeatedly demonstrated the technique by buying secondhand disks and reporting what they recovered.
Countermeasures
Reducing scavengeable residue is a lifecycle discipline rather than a single control. Retired drives need media sanitization before they leave, and paper needs shredding and locked disposal.
- 1
Data inventory and classification
Knowing which data is sensitive and where its copies live comes before every other measure.
- 2
Sanitize media before disposal
Erase or physically destroy drives before decommissioning, and verify the result instead of assuming it.
- 3
Limit access to shared storage
Apply least privilege on network shares and cloud folders, and clean up stale data on a schedule.
- 4
Encrypt stored data
Data that cannot be read without keys loses most of its value, on live systems and retired media alike.
- 5
Monitor file storage
Keep visibility into what is written where, and into copies of protected files that appear in unexpected places.
What software can and cannot do
Software cannot stop someone from searching a dumpster or a used disk. It does cover the copies made inside the organization, where most residue starts. How transfers are monitored is described on the file transfer and network share page.
| Control | Neutralizes retired media | Sees copies on shares | Records who wrote a copy |
|---|---|---|---|
| Media sanitization | |||
| Encryption at rest | |||
| Anexet file operations audit |
Where to start
Begin with the data that would do the most damage if it resurfaced, then find where copies of it actually pile up. A rule written for every file at once blocks ordinary work and gets disabled within weeks, while a rule for a few high-value folders survives.
The data that leaks by accident is usually the data nobody remembered to delete.
Anexet TeamHow Anexet handles this
Software cannot stop someone from searching a physical dumpster or a secondhand hard drive. That side of scavenging belongs to disposal policy, media sanitization, and physical discipline. What Anexet addresses is the digital residue inside the organization: copies, temporary files, and writes to shared storage that would otherwise appear and sit unnoticed.
The on-premise architecture keeps detection rules, captured content, and event logs within the organization's own infrastructure. This matters because the trail of residual data is itself sensitive.
Audit of file operations
Endpoint agents audit file operations on network shares. The full file name, size, and initiating process are recorded, so files that appear in shared folders leave a trace of who put them there.
Controlled shared storage
Access to and writes on network shares can be restricted by share name (allow or block lists), by file attributes, and by content. Files written to a share are checked against security policies and can be blocked or saved for review.
Shadow copies of transferred files
Files intercepted on removable devices and network shares are shadow-copied to controlled storage with configurable size limits. The record of what was moved survives even if the user later deletes the original.
Finding copies in unapproved places
File Systems Monitoring searches workstations for files that match hash banks of protected documents, a single hash sum, or file attributes such as name, extension, and size. It can act on what it finds remotely: copy, move, hide, set read-only, or delete.
Audit trail
Every file event is recorded with metadata: user, timestamp, and action taken. Investigators get a complete, attributable trail of how residual copies appeared and who handled them.
Anexet DLP
Learn more