I've tended to use copies of production, but sometimes obfuscated for security purposes.

My company (Red Gate Software) makes a data generator that can build data for you, in all shapes and sizes.