Sanitizing USB memory stick by overwriting dummy data

Question

I want to sanitize my USB memory stick. By 'sanitizing' I mean I don't want to leave any trace of what I wrote in the USB memory stick.

Since they are made with flash memory and flash memory controllers apply 'wear-levelling' algorithm, I'm wondering whether writing and erasing dummy data over and over again on the stick will do the job for me.

For example, if I have a 16GB stick and a 4GB movie file as dummy data, will writing and erasing this movie file 8 times (so that total of 32GB write happens) make other people impossible to figure out what I have written before?

I'm trying to do this sanitizing work via operating system. So I can't access certain 'reserved' memory space, such as space for firmwares or some other special purposes. But since my previous writes which I want to erase the records of also are done via operating system, I'm guessing that the method I'm asking may be a plausible method.

Answer 1

Short answer is no. This will not guarantee that nothing can be recovered. Simply because the method is slightly crude and would require some miracle for the data you write to drive to match the drive's size itself. Even one file "sexytalkwithmywife.txt" and "bankdetailsforthepast10years.pdf" can be in the span of kB, and you may miss those sectors regardless of how many times you write.

• Standard Methods

for windows there are various utilities like this one which will do complete data erasure for drives.

for linux the standard for a long time has been shred, where you would first run fdisk -l and lsblk to figure out exactly which drive you are supposed to wipe (important step, many a cry have happened because people didnt do this) then to do something like this:

shred –vfz –n 6 /dev/sdX

where -vfz is, in order, please tell me how far along you are continually, please dont bother me with permissions, please write zeros on the last pass. n is the number of times to write random data to each bit. and sdX is the drive you identified in the previous step.

• Recent Developments

The last i heard the community was still a wash with how to handle this for memory and ssd's since they apply load balancing and trimm support as you say. Kingston came out with a suite of tools for the specific data erasure of these kinds of hardware called Secure Erase, See their article here. But some people (myself included) do not like the idea of a software that specifies only one manufacturer and to my knowledge isn't open source.

Here's the issue, there's no main standard for this yet. Most manufacturers of ssds have applications in firmware that can be called upon for wiping data properly in these devices, which doesn't make things very easy for us. Most of us dont want to go searching around hardware specs to figure out how to do this properly per each individual drive. Unless I've missed more recent developments (a possibility in this area) we may just have to wait for better options for ssd's and the like to be absolutely sure. But for now, i doubt you are dealing with the kind of threats that shred or eraser cant handle.

Answer 2

If wear-leveling algorithms work as advertised, your approach should work.

Two things to keep in mind though:

1. How many overwrites / what volume of data is good enough to say you've not left behind any trace? This his hard to assess without access to internal data structures.
2. Doesn't your overwriting operation reduce the life of the drive? Yes, it will.

Answer 3

Alternatively you could use shred in linux. See shred.

Use

sudo fdisk -l

to figure out the directory to your USB drive. Assuming it is /dev/sdb, you can the use shred in this way:

sudo shred -v -z -n 10 /dev/sdb

Hope it helps.