Let's suppose I plugged in my UBS flash drive in my friends' PC and it got infected with malware. Is there a way I can wipe the USB drive without connecting it my or some other computer (and infecting it in the process)?
asked Nov 19, 2015 at 12:57
-
1There are ways to clean infected devices, but they require fairly specialist knowledge, especially if they involve firmware manipulation. Given the price of flash drives, you're better off physically destroying it and buying a replacement unless you have that specialist knowledge.– MatthewCommented Nov 19, 2015 at 13:04
-
2Flash drives are cheap - if you know it is infected, and don't need to recover any data from the drive, destroy it and get a new one. Then be more careful where you use it.– JonnyWizzCommented Nov 19, 2015 at 13:17
Add a comment
|
2 Answers
You can plug your USB drive on a virtual machine based on Linux. Before that, you can stop the automatic mount of externals drives.
After, you verify the recognition of your drive with:fdisk -l
You note his path: /dev/sdX, don't mistake with another drive !!!
You note his blocks count and their sizes (512 by default)
You can erase all datas on the drive with:
dd if=/dev/zero of=/dev/sdX count=<blocks count> bs=<blocks size>
After that, your drive will be totally erased. If you are paranoid, you can delete you virtual machine too. This method doesn't clean the potential infected firmware of your drive.
-
Interesting. Can I load Tails from a DVD, for instance, and format the flash drive using it? Commented Nov 19, 2015 at 13:45
-
@DavidBryant I don't know Tails, but
ddcommand is a common command in Linux distribs. So, you can boot on this, and execute the commands– SorchaCommented Nov 19, 2015 at 14:32 -
I meant, I could also load my Linux GUI (Tails, Ubuntu, DSL, etc), stick in infected flash drive and just format it with the equivalent of "My computer"? Commented Nov 19, 2015 at 14:58
-
1@DavidBryant yes, but you increase your attack surface (which is still minimal as common Windows malware don't try to exploit Linux apps) by making a fairly large GUI program to parse the drive's metadata, and it may only be able to format into Linux filesystems, making your drive useless on Windows. It also won't wipe potential data outside of the partition boundaries nor in the MBR.
ddis a safe option, doesn't attempt to read & parse data from the drive and wipes everything. An alternative is to useshred -n 1 -v /dev/sdX. Commented Nov 19, 2015 at 20:38
If it was just an autorun, connect it to a non-windows computer and take a look at the files. There should be an "autorun.inf" file that references some other file(s). Delete them and everything (should) be okay. Or delete everything you don't know just to be sure.
Be aware that it is not a panacea. If the infection put a payload inside your executable, PDF or office document (or some other type of) files, you will not know it until you pass them through a scan.
