1

Internal SSD can be wiped with TRIM, but USB sticks are external SSD. They're apparently difficult to wipe securely enough to make forensic analysis of the device impossible. This question has been asked before, about 4 or 5 years ago and the information is probably outdated. Looking for up-to-date advice on how to securely wipe files on a USB from a bootable media.

Is it possible to have a setup that can securely wipe USB with TRIM? Anyone know of any programs that will securely shred files on USB, making them impossible to recover via forensic recovery software?

Improve this question
2

2 Answers 2

Reset to default
1

Unlikely. SSD/usbs have firmware that automatically shuffles the available storage to account for errors in sections of the flash storage. Its possible that your important files are now stored on a bit of flash that effectively does not exist in the eyes of the OS and therefore can not be securely wiped.

The easiest way to be fully sure that none of your data is recoverable is to use full disk encryption from the beginning. Without the key, the data on the drive is effectively random and useless. That way if you ever sell or lose your drive, no amount of analysis will get any data out of it as long as your key was secure.

I'm also not sure TRIM can actually be used to securely wipe drives but I will leave that up to someone who knows more about it.

Improve this answer
3
  • The host computer does not see the flash blocks, is unaware of the wear leveling and marked bad blocks. full disk encryption provides the best solution. Further when a block write fails and the block is put in the bad block list it most likely contains the written data with perhaps only a few bits in error.
    – zaph
    Jan 16, 2019 at 22:29
  • I thought TRIM was a optimising technique to improve performance on SSDs
    – LtMuffin
    Jun 20, 2019 at 18:57
  • @Leon185 That is also my thought but I am not an expert on what it does.
    – Qwertie
    Jun 20, 2019 at 23:58
-1

In the last forensic Assessment we came across the same situation and to figure out why this happens or for curiosity how can we completely flash the device which can not be recovered so I came across the solution you can write /dev/zero using dd for at-least 5 iteration. with every iteration it keep changing the super-block depends on the file system.

If you can do below things in this can make your device unrecoverable in at-least encase. 

sudo dd if=/dev/zero of=/dev/sdc bs=512 count=16

sudo dd if=/dev/zero of=/dev/sdc bs=1M

you can give a try to various combination also.

repeat this at-least for five times this can make your USB unrecoverable

Improve this answer

Not the answer you're looking for? Browse other questions tagged .