The Ghost in the iPod

What an iPod Classic 5th gen still remembers about the person who owned it.

A package in the mail

It started as a hardware story. I bought a modded iPod Classic, one of those fifth-generation bricks that the enthusiast scene keeps alive with flash-storage transplants and fresh batteries. I wanted the toy. I plugged it into my PC expecting to load it up with music.

Windows had other plans. The drive showed up as a letter, G:, and then refused to say anything else. No files. No capacity. “The volume does not contain a recognized file system.” If you have done this before you already know the punchline: the iPod was formatted on a Mac. Under the hood it was HFS Plus wrapped in an Apple Partition Map, and Windows simply does not speak that language.

Here is the part worth sitting with for a second. The device was not broken. It was not empty. It was full. Windows just could not read the lock on the door. And the assumption a lot of people make, the assumption that lets this whole story happen, is that an unreadable drive is a blank drive.

It is not. It never is.

Imaging a stranger

To read an Apple-formatted volume on Windows without touching the device, you make a raw image. A byte-for-byte copy of the entire disk into a single file, read-only, the iPod never written to. Sixty gigabytes crawled off the thing over a tired USB 2.0 link while I made coffee.

Then you point an HFS Plus extraction tool at the image, and the door opens.

What fell out was not music. Or rather, it was not only music. It was a person.

And here is the part that genuinely got me, the part that is, if you let it be, a little funny. This iPod last synced to a computer in 2009. The photo cache still carries that autumn’s date and was never written again. Which means this data sat in a drawer, then a box, then a padded mailing envelope, for the better part of two decades, and it did not rot, it did not fade, it did not quietly forget itself the way we assume old things do. It waited. I plugged in a gadget old enough to drink and it handed over a whole intact human being as if no time had passed at all. Storage does not get sentimental about the years. It just keeps the receipt.

The shape of a life, reconstructed from a music player

The first thing any iPod tells you is its name, because the owner typed it into iTunes years ago and never thought about it again. This one was named after its owner. First name, possessive, “iPod.” That alone is more than most people would volunteer to a stranger.

From there it unspooled fast.

There was the music, sixty-one albums of it, and music is a fingerprint whether you want it to be or not. Mid-2000s dance and trance. A television soundtrack compilation. Smooth jazz, the real kind, the kind you do not put on a playlist ironically. Coldplay, more than once. You can place a person in a decade and a mood from a library like that, and you can place them in a life stage too, because tucked in alongside the albums were self-help audiobooks about negotiation and personal effectiveness, and podcast subscriptions for a nightly network news show and a photo-editing tutorial series.

Then the folders that were not music at all.

Calendars. Six of them, holding one thousand five hundred and fifty-four events between them. Work, home, birthdays, a vacation, and, memorably, one labeled for a vacation rental. The entries run from 2007 into 2009, and a calendar packed that densely is a map of a person in time. Where they were, when, and who with. Business lunches and conference calls. A degree being finished one course at a time. Kids driven to school and to the airport. An aging parent whose house needed a contractor. The unremarkable, complete machinery of a middle-aged life, every errand of it still dated and still legible.

Contacts. Six hundred and thirty-two of them. Three hundred and forty-eight came with email addresses. Names, mobile numbers, employers. Not the owner’s data anymore. Everyone else’s. Every person who ever handed this man a phone number was now sitting on my hard drive because he sold a music player, and not one of those six hundred and thirty-two people got a vote.

Notes. Study notes, actually. Quiz material for a nutrition course and a health course. Not a teenager cramming for finals, either. Set against the calendars, this was a working professional well into middle age, finishing a degree the long way around, on his own time, with an iPod for a flashcard deck.

And photos, which deserve their own section, because the photos are where I had to correct myself.

The man this iPod belonged to did nothing wrong. He is not a scammer or a data broker or a cautionary villain. He is a guy who, like almost everyone reading this, once owned a gadget, stopped owning it, and assumed that was the end of it.

That is the whole point. He is you.

The ghost had a name

This is the part people expect to be hard. It is not. It is just reading, done patiently, with the pieces laid side by side.

Start with the music, because a library is a timestamp. The dance and trance and the teen-drama soundtracks place the buying years in the mid-2000s. The smooth jazz, the Sade, the Journey greatest hits place the buyer a generation older than the trance alone would suggest. And the audiobooks settle it. A man does not load a negotiation boot camp and a Stephen Covey course onto his iPod for fun. He loads them because he has a job that rewards being better at them.

The calendars name that job without ever stating it. There is a calendar called Work, and a second one synced out of Microsoft Entourage, which was the corporate Mac mail client of the era. Inside them: business lunches logged by the other person’s name, a hotel stay at a Courtyard Marriott, an AMEX reminder, conference calls, and a product demo recorded against a contact at a national laboratory. This is a man in sales or business development, the kind who travels to clients and keeps score in a calendar. It all ran on Pacific time.

The same calendars carry the rest of him. Children driven to school and dropped at an airport. An aging parent whose house needed a contractor. A man with kids old enough to fly alone and a parent old enough to need looking after is, almost by arithmetic, middle-aged, and set against a working life long enough to fill six hundred and thirty-two contacts, he lands squarely in his fifties by the time the iPod stopped syncing in 2009.

Then the study notes finish the portrait. They are not light reading. They are college coursework, a nutrition course and a Health 100 survey class, quiz question by quiz question. A man in his fifties, mid-career, on the road for work, was sitting undergraduate exams. He had gone back to school, and he was using the iPod as a flashcard deck between flights.

None of that took a password. Every line of it was a folder with a plain name. But notice what just happened, because this is the actual mechanics of de-anonymization. You do not need the answer written down anywhere. You assemble it. A first name from what he titled the device. A region from a time zone. A trade from a calendar. A life stage from school runs and a parent’s contractor. An employer and an entire professional network from the address book. And once you are holding a name, an employer, a region, and an age, public records close the gap in an afternoon.

So I closed it. I know his full name. I know his date of birth. I know the school he enrolled in to take those courses. I am not going to print any of it, and I am not going to print where he lived. He is a private person who did nothing wrong, and this article does not need his name to work. It needs you to understand that his name was sitting right there, reachable, and the only thing between him and a stranger knowing exactly who he is was that the stranger decided to stop looking. You should not have to count on the stranger deciding to stop.

The photos, and the mercy that is not really a mercy

My first instinct was that the photos were a dead end. The iPod did not store them as ordinary image files. It stored them the way iPods did, in a proprietary thumbnail cache, a single blob of raw pixel data with no headers and no obvious structure.

So I reverse-engineered the pixel format. It took three guesses. The images were sitting in there as raw 16-bit color, and once you know the width, the height, and the byte order, the blob resolves into pictures. Fifty-one of them. A stranger’s photo library, rebuilt from a file that was never meant to be read off the device.

Here is the mercy. The pictures came back at screen resolution, the size the iPod displayed them, and the cache format strips the metadata when it builds those copies. No EXIF. No GPS. No coordinates quietly pinning a house to a map.

So I could not stand up the version of this article that the internet would have wanted, the one with a satellite pin and a triumphant “and here is where he lives.” Good. That article should not exist about a private person, and I would not have written it.

But do not mistake a technical accident for safety. The location data was not absent because anyone protected it. It was absent because a photo cache format from the 2000s happened not to copy it across. A phone from any year since would have. The photos in your pocket right now almost certainly carry the coordinates of the room you are standing in. The iPod was not discreet. It was just old.

The one thing that was locked

There is a detail in this story that I cannot stop turning over.

Some of the music would not play. Sixty-eight of the tracks were DRM-protected purchases, sealed to an account I will never have, and the same is true of the store-bought videos. The entertainment industry spent a fortune making sure that if this iPod fell into a stranger’s hands, the stranger could not play the songs.

It worked. I cannot play the songs.

And every other thing on the device, the six calendars, the six hundred and thirty-two contacts, the study notes, the fifty-one photos, the entire recoverable shape of a human being, had no protection of any kind. The albums were in a vault. The person was lying on the floor next to it.

We built elaborate locks for the content. We built nothing for the life it travels with.

What this is actually about

There is a genre of security talk called de-anonymization, and the uncomfortable secret of the genre is that most of it is not hacking. It is reading. The information was not hidden. It was not encrypted. It was not even deleted. It was sitting in plain folders with plain names, and the only thing standing between it and the next person to own the hardware was a filesystem Windows did not recognize for about forty minutes.

The owner did nothing unusual. He did not get phished. He did not reuse a password. He did the single most ordinary thing a person can do, which is to stop using an old device, and the device kept his life on it anyway, faithfully, for years, waiting.

So here is the actual content of this article, the part to keep:

A drive that looks empty is not empty. “It would not open on my computer” is not “it was wiped.” When you sell, donate, gift, recycle, or bin a phone, a laptop, a tablet, a music player, a game console, or a camera, the data does not leave with your intent to be rid of it. It leaves with the hardware. To whoever holds the hardware next.

Wiping a device properly is boring and it takes ten minutes and almost nobody does it. Do the boring thing. Factory reset is the floor, not the ceiling. Encrypt drives so that “unreadable” actually means unreadable. And before any device leaves your hands, assume the next owner will be more curious and more capable than you would like, because one day one of them will be.

I bought an iPod for the hardware. It came with a ghost. The ghost was not hiding. Nobody had told it to leave.

Go wipe something.