Using an example to comprehend why “safely” erasing a drive yields better results than filling it up with meaningless data

Question

A hypothetical 1GB USB stick is full of sensitive documents/images/etc. and it is not encrypted.

The owner wishes to discard it and is aware of having to safely erase it first.

There are several tools and utilities to do this. Some can be configured to do it “faster yet less safely”, others do it “slower but more safely”.

As opposed to have it erased using all the different ways known to do this, the owner chooses to simply drag all the current items to the recycle bin and then paste one 1GB (~2-hour) black screen movie file to the USB stick.

Again, no fancy erase utilities are used. The USB stick is then discarded.

If it falls into the wrong hands, can any of the sensitive files (that filled the stick before the movie file was pasted) be retrieved?

(1) If no, why do complex hard drive erase utilities exist? Some of them feature “safe” erase procedures that take houuurs, when simply filling a soon to be discarded HD with meaningless files, can do the job?

(2) If yes, how can 2GB (movie file + sensitive files) co-exist in a 1GB stick? Seems to me like the only logical explanation is (a) the movie file was in fact less than 1GB, (b) the USB stick was secretly larger than 1GB as stated, or (c) the movie file was copy-pasted only partially and the owner did not notice.

Answer 1

There was a worry that hard-discs (of an appropriate vintage now) would be vulnerable to having overwritten bit read. Rebutted here: https://www.nber.org/sys-admin/overwritten-data-guttman.html

Therefore schemes were devised to do multiple passes overwriting the data enough times and randomly so that no future development could extract data.

For a USB stick the main risk is probably 'bad blocks' - where the original data is preserved read-only, because the re-write failed. In this case it doesn't matter how many times or how cleverly you over-write it; someone who can dismantle the drive and read the flash directly can extract (some of) your original data. Drives handle bad-blocks by over-provisioning - the stick has more space than is exposed to the operating system, and remaps bad-blocks to the reserved space when they fail. Flash tends to fail read-only (i.e. fail on write), so the old data is present, if an attacker reads the flash directly.

Answer 2

Well, it depends a bit on what flash drive is used. In general, flashdrives (and SSDs for that matter) use wear-leveling and over-provisioning. So, if you're using expensive, industrial grade flash drives (f.e. Delkin) you have some over-provisioning (more storage than advertised). Consumer-grade flashdrives generally do not have much over-provisioning.

Of course, if the movie was less than the storage-size or if the copying was incomplete, that would explain the possible retrieval.

In the old days, even up to the 5 Meg hard drive (e.g. IBM 2314), head alignment on the hard drive was not as precise at it is now. That meant that, with more precise control hardware (yes: change the controlling hardware) and some luck, you could retrieve some of the bits that were overwritten, reading a bit to the side of the track. Doing a 5 or 6 pass write over them in general made the retrieval of the original bit impossible. Many safe-erase utilities still think like they're in that era.

Answer 3

If it falls into the wrong hands, can any of the sensitive files (that filled the stick before the movie file was pasted) be retrieved?

Possibly, yes, but not because your idea of copying files is any less secure than using the software tools. There may be data that was previously written to now bad sectors or "hidden" storage space on the drive which neither your copying of files, nor the software tools, can overwrite.

As for your other question:

Why do complex hard drive erase utilities exist? Some of them feature “safe” erase procedures that take houuurs, when simply filling a soon to be discarded HD with meaningless files, can do the job?

There are multiple reasons, and they still have some (perhaps limited) value:

1. A single pass wipe is probably easier and faster than your proposal. With your idea you need to find enough data to exactly fill up the space on the drive. If your files are too big it could fail, or too small and you may leave some space untouched at the end of the drive. A utility can do a single pass quickly without this problem.
2. Some companies must follow outdated standards that require multiple passes for a secure wipe. They need to do this even though they know it isn't necessary, simply until the compliance rules are updated.
3. There's a chance that very old hard drives do have some amount of memory after a single wipe, and out of an abundance of caution it doesn't hurt to do multiple passes.
4. For paid products with a warranty and insurance, a company can lean on that for reassurance that they are protected if something goes wrong with the software.

But given that some sectors may not be overwritten by the security tools either, for extremely high security data, complete physical drive destruction is still used.