2

Are there any commands, tools or python libraries to securely wipe specific files from an SD or micro SD card (devices that use flash memory)?

For example, with a regular magnetic hard drive, you can use the Wipe command to securely delete files.

I am having difficulty finding such tools.

  • Um......sudo rm -rf /Path/To/Drive? – JBis Aug 7 '18 at 20:09
  • @jbis rm does not overwrite the data of the file, it just marks it as space that can be overwritten later. Op is asking for secure deletion methods – J.A.K. Aug 7 '18 at 20:18
  • @J.A.K. My bad. Missed the "securely wipe" sorry. – JBis Aug 7 '18 at 20:25
  • I don't really want to write an entire response here, but I'd advise anyone writing one to be aware of the trim command, and the differences that an SSD has when writing to blocks. (Wear leveling, etc) en.wikipedia.org/wiki/Trim_(computing) – Steve Sether Aug 7 '18 at 22:01
  • @SteveSether Very interesting, thank you for sharing. I was not aware of that. – SomeRandomGuy12 Aug 7 '18 at 22:28
2

Flash storage is inherently different from spinning disk storage at a physical, and operational level. Unlike spinning disks, flash storage has a limited amount of write cycles. The solution to increasing the lifespan of the media to something usable that storage makers have come up with is called wear leveling. Essentially what this means is that when you write to a logical block on the disk twice, you're in all likelihood writing to two different physical blocks in the storage media.

The answers that claim that simply re-writing to the blocks is sufficient don't take this into account. You asked specifically about SD Cards, which according to this answer is sometimes implemented in SD cards, and other times not. So it's not so easy to give you a straight answer.

In addition, before physical block can be re-written to, it has to be erased first. This takes some extra time, and reduces performance. To make matters worse, the flash device has no idea which blocks are in use, and which aren't unless it's told This is what the trim command is used for. In a nutshell it tells the underlying media which blocks it can free up, so that the storage media can then perform the erase operation in the background during idle time. The trim command is specific to the ATA/SCSI bus, and again, you asked about SD cards. I don't know if there's an equivalent command for the SD card market, but it's something you should keep in mind.

The end result is that erasing in Flash storage isn't as simple as erasing a spinning HDD. The fact that you can't be assured you're writing to the same physical sector complicates matters greatly. The best you can hope for for erasing a file on an SD card is to write to every single sector on the drive.

Even this isn't perfect. Some manufacturers have spare sectors available when one sector wears out the logical block gets mapped to a new sector. So it's possible that even over-writing all logical sectors won't over-write all physical sectors. (BTW, the same is true for spinning disks).

1

Are there any commands, tools or python libraries to securely wipe files from an SD card (flash memory)?

There are many tools that can "securely" wipe files from the "block-level" disk (i.e., the disk as it is exposed to the operating system as a block-level device such as via a "/dev/sdX" file). In forensics terms, this type of wiping means that a typical "physical extraction" of the SD card will not show any evidence that the files were on the disk. One simple tool that can be used to securely overwrite allocated clusters as well as directory entries (here I'm assuming the SD card is FAT32) is the Linux "dd" command.

Your question also seems to hint at the fact that the data on an SD card will typically be stored on a Flash memory chip, which is controlled via a memory controller. The memory controller can reserve parts of the flash memory and map different parts of the flash memory to the same logical block/sector of the block device.

Thus, if someone were to go "beyond" ordinary disk level forensic imaging and perform a "chip-off" analysis of the SD card it is possible that the files which appears to be completely overwritten at a "disk level" may actually have some remnants at the flash level. This type of "chip-off" analysis is often expensive and error-prone, but if you want to ensure that not even this type of analysis can recover data from your Flash memory chip you could try a few different things. For example, you could use "dd" to overwrite the SD card multiple time in the hopes that the memory controller will not "save" any parts of the Flash memory (however this is contingent on knowing how the memory controller actually operates, which is often proprietary).

  • Thank you very much for explaining that. Essentially from what I understand it seems the best solution is to write at the block level using tools like DD? Please correct me if I am misunderstanding. – SomeRandomGuy12 Aug 7 '18 at 21:54
  • 1
    Yes, it sounds like this could work for you. The "dd" tool can be used to overwrite/wipe entire drive. You can also overwrite individual files if you know where the file content and directory entries are located on the drive. – hft Aug 7 '18 at 23:11
  • 1
    @SomeRandomGuy12 for example dd if=/dev/zero of=/dev/sdb bs=16384 or you could use /dev/urandom instead of /dev/zero or you could do both. Alternatively you could just buy some super cheap 1gb SD cards and burn or crush them. – cybernard Aug 9 '18 at 0:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.