Interesting thread... and, as usual, I can't help but stick my nose into it.
1st: Yes, it's the IT person's job to make sure that backups are performed, and restores are tested.
2nd: Formatting the drive is a bad thing; it raises suspicion, and without being too judgemental, the statements about cookies/files/history made *me* suspicious. I know right now that if they walked into my office and walked me out of the building, that they could go through my computer and there wouldn't be so much as one off-colored joke on my system. I wouldn't have to worry about formatting my drive. Besides, what are they going to do, fire you if they find a picture on your PC? They can't report that in a reference (just stuff like "Yes, he was always at work on time, no he didn't take an unusual amount of sick days". Of course, some stuff is illegal, (i.e. child porn) and that could be a whole different ballgame. Once again, not inferring anything, just making a point.
3rd: If you got paid to do it, develop it, etc. it belongs to the company. In fact, if you signed a non-competitive agreement, depending on the terms, you may not be able to go out and do similar development for a competitor for a time period. I had to deal with that once with medical software that I had written. I don't do non-competitive contracts anymore.
4th: Taking #2 into account, there are things that past employers can do to mess with you; questions not answered, terse responses, "canned" responses put doubt into future employers' minds.
Just to follow up with a little story of my own. I left the employ of a company for which I had set up a pretty good sized ISP (about 750 users in all). I also do consulting at a couple of banks. After I left, people came up and asked me if I was going to do something to the ISP. Statements like "I know you could screw them over good, if you wanted to. You gonna?" My answer was "Yes, if I wanted to, since I know they haven't changed all 750 passwords (and I have relatives using the system still, and I could get their password if I wanted it.) BUT, why would I tarnish my reputation (and thus lose my consulting business as well) over something as piddly as revenge? I wouldn't be winning that situation at all. Best to let them realize their own mistake." And the mistake was, that within a year, since there was nobody to maintain it, the system went down and was discontinued.
I guess what I'm trying to say is this;
As IT professionals, it's understood that we have access to things a normal employee wouldn't. We can see payroll stuff, we can see medical stuff, we are (supposed to be) the first ones told when someone is getting the sack. WE MUST MAINTAIN A HIGHER LEVEL OF INTEGRITY.
The passwords are theirs, not yours. The work you did that you got paid for by them is theirs. The reputation is YOURS. Don't ruin it over something as petty as withholding the password. If you had a company car, would you refuse them the keys?
I'm done rambling. Flames will be redirected to /dev/nul
--Greg