Sanitizing a USB HDD in Linux

Question

I want to check that an external USB hard disk drive is free of viruses and malware before connecting it to my primary use computer.

I have it in mind to perform the following steps to ensure that the drive is effectively clean:

1. remove the HDD from an old laptop
2. boot from a Linux CD, known to be clean
3. connect the USB HDD
4. open terminal
5. navigate to the USB HDD directory
6. enter the ls -a command
7. delete any files or directories that I cannot account for

After taking these steps, should I be able to assume that my USB HDD is completely safe to use?

(Notes: Unfortunately, I am not familiar with running virtual machines, and obviously, I don't trust third-party software scans to do a good enough job of detecting everything for me.)

UPDATE:

Here is some more background information:

Yesterday, I bought a brand new 1TB USB HDD, which was NTFS formatted out of the box. I purchased it to backup files from my MacBook, which according to Avira and MBAM, was free of unwanted infections.

After connecting the USB HDD, the first thing that I did was to reformat it to utilize the Mac OS Extended (Journaled) file system, and afterwards, I copied my files to the drive.

Then, I erased the hard drive on the MacBook and installed a fresh copy of OS X via Internet Recovery.

If Avira and MBAM failed to catch anything, how can I make certain that I won't be reintroducing anything unwanted when I connect the USB HDD to my newly reformatted machine?

Answer 1

I don't believe you would be sufficiently secure using this method. While malware can create file and directories it can also insert itself into existing files and programs. Then once you have deleted everything you didn't expect and plugged the drive in you could become infected after opening an expected file.

Answer 2

I used the following steps when I was planning to re-cycle an old laptop HDD into an external storage. Perhaps this may give you some ideas. Note: This procedure will delete all your data and you will not be able to recover it.

1. Got an HDD Enclosure kit with USB. This converted the old HDD into an external drive.
2. Connected to my Laptop running Linux but did not mount it.
3. Went to System > Hard Drive.
4. Found my external HDD.
5. Re-format the HDD (Write 0's to the entire disk). This will delete all files from the disk, format it and write ZEROS (0) to each sector.

This will basically delete all data from the drive and wipe everything including any malware or malicious files.

good luck !

Answer 3

In regards to your updated question : when you reconnect, the drive, take a look and see whether it enumerates as an USB drive and not something else, like a keyboard (BadUSB uses this to type in malicious commands). Assuming the drive still appears as a drive, the risk could be in the files you backed up.

On an up to date system it should be pretty safe to keep pictures, videos, music and plain text documents. Files that can contain active code such as Office documents (which can contain macros) and PDFs can still be a risk. Executable files like applications and scripts are definitely risky though, I would recommend deleting them and redownloading clean copies from the App Store or the developer's sites. For scripts (Bash, Python, PHP, etc) I suggest you open them in a text editor, read and understand the code to make sure nothing funny was added to it by previous malware.

However, besides the BadUSB exploit which has no easy mitigation, you should be safe to plug the drive in on a up to date OS and browse its contents as long as you don't open risky files themselves. A zero-day exploit that would automatically execute code on opening a folder or connecting a drive would retail for thousands on the black market and it's unlikely someone would "waste" it on you unless you're a really valuable target.

---

Original answer :

First off, you have to make sure the drive's USB controller isn't malicious (like BadUSB). There is no 100% sure way to tell but if the drive enumerates as a storage device and not as a keyboard (which would type in malicious commands) you're most likely good to go.

Once the controller is considered clean you should worry about the actual data on the drive which could be crafted in such a way to exploit vulnerabilities in partition and filesystem related code. All data on the drive can be wiped using either the ATA secure erase command with hdparm --security-set-pass pass /dev/sdX and then hdparm --security-erase pass /dev/sdX, or the shred utility with shred -n 1 -v /dev/sdX.

Answer 4

You don't know what kind of trickery with underlying hardware the malware has done.As far as we know,it might have even compromised the controller.So nuke it from orbit(if you're really feeling paranoid also nuke the controller firmware).