An organization is disposing of a system containing sensitive data and has deleted all files from the hard disk. An IS auditor should be concerned because:

This statement is incorrect; logically deleted data is often *easily* retrieved using common recovery tools, which is precisely the auditor's concern.

While backup copies are also a concern for data sanitization, the question specifically refers to the hard disk being disposed of, and the immediate issue is the physical data retention on that disk.

Efficiency is not the primary concern when dealing with sensitive data disposal; the paramount concern is ensuring the data is irrecoverable, regardless of the method's speed.

When files are logically deleted from a hard disk, the operating system merely removes the pointers to the data and marks the space as available, but the actual physical data remains on the disk until it is overwritten. This allows sensitive information to be easily recovered using data recovery software or forensic techniques, posing a significant security risk during system disposal.