3

I have read that the "safest" way to make sensitive USB contents un-recoverable is to hammer to pieces the USB stick.

Indeed, a quick search on Google shows up hundreds of ways to "recover usb files" after a deletion or corruption of files.

I do understand that a simple "delete" will leave traces and will make the contents recoverable by some advanced users.

But, why wouldn't a formatting of the USB work? And, what about software like CCleaner, DiskWipe or Eraser?

Why would it be so "easy" to recover those contents?

Thanks,

  • 1
    Has the data been overwritten? | "a simple "delete" will leave traces and will make the contents recoverable by some advanced users" Not exactly, depends how you delete it. – JBis May 20 '18 at 0:36
  • I was thinking about the typical Windows delete. Regardless of the trash folder, would that kind of simple deletion be enough on the USB itself? – Peanuts May 20 '18 at 0:46
  • 1
    no, but if you format and refill 100% of the space with kitten pics, 99.999% of the old data will be destoyed. – dandavis May 20 '18 at 20:24
3

What happens when you 'delete' something?

A filesystem looks something like this:

00 START NTFS FILESYSTEM
01 START FILE LIST
02 test.txt 6-8
03 molerat.jpg 9-4207
04 END OF FILE LIST
05
06 Hi Jamie,
07 Could you get two eggs and if they have milk, three?
08 Thanks!
09 qDJFIFXcz5nW2ebBraYv
10 BbUTUNuxhh41TS2DwCfR

So the file list contains which file is where and how large it is. Without such a central table, a computer would have to read the whole drive to find any particular file. Or, without a filesystem identifier (line 0), it would have no idea how to read the file list because it doesn't know how it is structured.

You can't delete something: space from a USB stick doesn't go missing. You can only read and write bits on certain positions. So when we say "deleting", we typically mean "overwrite the data with zeroes".

When you delete a file, it deletes the entry in the file list.

When you format a drive, it deletes the filesystem identifier (line 0).

So the files are all still there, you are just missing a reference to them. If you try to read data without having a file table, you don't know whether line 10 is part of another file, or a new file: you'll have to try and find starting markers (such as JFIF in jpg files) and see if you can read data from there.

To really erase something, you will need software that overwrites the file, not just deletes the file entry. There is lots of software that does this, search for "secure erase" or something. Overwriting a file multiple times is usually not necessary (unless you handle very sensitive data, then you will want to read up on the exact technicalities of the storage medium you're using).

Can data be retrieved from a USB stick after overwriting?

USB sticks and SSDs are very similar in this regard: they are both NAND flash storage, which truly erases a cell's contents when it is told to erase a cell. But each cell can only be written to a certain number of times before it breaks. To use each cell optimally, sticks may do "wear leveling", where it keeps an internal counter of how often each cell has been written to. (SSDs always do this, USB sticks (as far as I know) rarely.) Your secure delete software might try to write 00000 to position 7, but the controller in the device might decide "cell 7 has been written to more than cell 919, so I'll store this new data in 919 instead". Next time the computer asks for the data from position 7, the stick will remember the mapping and return data from cell 919.

Here, too, data might still be present even if your software instructed the stick to overwrite it, though it may be very hard to get it out (you'll probably have to do some soldering to get around the controller and read each cell). TRIM is a command which, when issued to the stick (or SSD), will erase all cells which are marked as empty. So if it has not reused cell 7 yet, then it knows that it is empty (because it knows the data is now stored in cell 919). Whenever it is told to TRIM, it will actually erase the old data. Until it does that, however, the data is still there.

  • 1
    I don't know of any USB flash drives that support TRIM. I don't think they really exist. – forest May 20 '18 at 12:42
  • Fascinating thanks. If I understand correctly, formating is just another way of messing with the file references (but leaves the file contents alone). So you need to overwrite the memory with zeros or random content - which needs from a separate software, right? – Peanuts May 20 '18 at 15:14
  • 1
    @Peanuts some utilities will ask if you want to overwrite while formatting – multithr3at3d May 20 '18 at 15:26
  • 1
    @Peanuts Generally yes, but indeed as \@multithr3at3d says, some of them have this built-in. – Luc May 20 '18 at 15:37
  • re the part about trying to find markers, you should mention that actual blocks are not stored in physical order like they are in magnetic, so even if you found the start of a jpg file, you would have no way of correlating that to the EXIF meta at the end of the jpeg (or any other jpeg), for example, since the image data will be far larger than the block size. Also, some drives can compress/parity/ecc/stripe the data coming in to different blocks, so a hex dump of the flash won't always yield block-length plain-text runs. – dandavis May 20 '18 at 20:38
1

When you delete a file or even format the drive without zeroing or overwriting it, that merely gives a permission to re-use the area where the data used to be. Until it gets overwritten by something else it's recoverable. As devices with flash memory usually tries to write every part of the drive equally to decrease write cycles on a single location, as a side effect the data may be recoverable longer than on a traditional hard drive.

Zeroing the space during format already makes it much harder to recover the data with usual data recovery softwares, but writing random data is even better. For single files there are software that overwrites the current location of the file before freeing it, but (due to the fact mentioned above) there might be copies of previous versions of the same file.

That's why I'd recommend erasing sensitive information by saving a random content file that fills the drive. For example sdelete with -c drive-letter does exactly that.

  • Very interesting thanks. So formating and zeroing would be two different processes? It's not clear to me... I always thought formating was like reseting everything up, but it seems like it just "melts" the contents into a mass, to make them re-usable. – Peanuts May 20 '18 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.