1

This question already has an answer here:

Internal SSD can be wiped with TRIM, but USB sticks are external SSD. They're apparently difficult to wipe securely enough to make forensic analysis of the device impossible. This question has been asked before, about 4 or 5 years ago and the information is probably outdated. Looking for up-to-date advice on how to securely wipe files on a USB from a bootable media.

Is it possible to have a setup that can securely wipe USB with TRIM? Anyone know of any programs that will securely shred files on USB, making them impossible to recover via forensic recovery software?

marked as duplicate by Steffen Ullrich, schroeder Jan 16 at 9:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

Unlikely. SSD/usbs have firmware that automatically shuffles the available storage to account for errors in sections of the flash storage. Its possible that your important files are now stored on a bit of flash that effectively does not exist in the eyes of the OS and therefore can not be securely wiped.

The easiest way to be fully sure that none of your data is recoverable is to use full disk encryption from the beginning. Without the key, the data on the drive is effectively random and useless. That way if you ever sell or lose your drive, no amount of analysis will get any data out of it as long as your key was secure.

I'm also not sure TRIM can actually be used to securely wipe drives but I will leave that up to someone who knows more about it.

  • The host computer does not see the flash blocks, is unaware of the wear leveling and marked bad blocks. full disk encryption provides the best solution. Further when a block write fails and the block is put in the bad block list it most likely contains the written data with perhaps only a few bits in error. – zaph Jan 16 at 22:29
-1

In the last forensic Assessment we came across the same situation and to figure out why this happens or for curiosity how can we completely flash the device which can not be recovered so I came across the solution you can write /dev/zero using dd for at-least 5 iteration. with every iteration it keep changing the super-block depends on the file system.

If you can do below things in this can make your device unrecoverable in at-least encase.

sudo dd if=/dev/zero of=/dev/sdc bs=512 count=16

sudo dd if=/dev/zero of=/dev/sdc bs=1M 

you can give a try to various combination also.

repeat this at-least for five times this can make your USB unrecoverable

Not the answer you're looking for? Browse other questions tagged or ask your own question.