0

It seems data resides in USB somewhere until it's completely overwritten. But is there a way to delete big directories 10-100GB or so without zero-filling the remaining space and only eradicating those specific directories? Would the history of deleting those is eraseable too?

Can someone when recovering deleted data also know when the file was deleted (not when it was last written but deleted)?

1

Not really - it's the same problem as with SSDs, in that the way flash memory works in both USB drives and SSDs involves a certain amount of overcapacity and the ability to mark certain areas as unusable. There is always a risk that data remains in a currently unusable area of the device, but which could be recovered by specialist tools.

Best option is usually to encrypt the whole drive before putting any sensitive data onto it, then only encrypted data will be left on any currently inaccessible sectors, which, without the rest of the data and the key (assuming a sensible cipher mode), should be impossible to turn back into useful data. If you already have sensitive data on the device which you need to be completely unrecoverable, only real option is physical destruction.

3
  • Can someone when recovering deleted data also know when the file was deleted (not when it was last written but deleted)? – Joe Black Oct 26 '18 at 9:08
  • Only if the metadata is recovered. The raw data has no concept of when it was created, modified or deleted - these are all stored elsewhere. – Matthew Oct 26 '18 at 9:28
  • can the metadata also be recovered for something that was deleted in a normal fashion and then from recycle bin (after deleting file from USB it still shows in computer's recycle bin from where it is then deleted)? – Joe Black Oct 26 '18 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.