6

A hypothetical 1GB USB stick is full of sensitive documents/images/etc. and it is not encrypted.

The owner wishes to discard it and is aware of having to safely erase it first.

There are several tools and utilities to do this. Some can be configured to do it “faster yet less safely”, others do it “slower but more safely”.

As opposed to have it erased using all the different ways known to do this, the owner chooses to simply drag all the current items to the recycle bin and then paste one 1GB (~2-hour) black screen movie file to the USB stick.

Again, no fancy erase utilities are used. The USB stick is then discarded.

If it falls into the wrong hands, can any of the sensitive files (that filled the stick before the movie file was pasted) be retrieved?

(1) If no, why do complex hard drive erase utilities exist? Some of them feature “safe” erase procedures that take houuurs, when simply filling a soon to be discarded HD with meaningless files, can do the job?

(2) If yes, how can 2GB (movie file + sensitive files) co-exist in a 1GB stick? Seems to me like the only logical explanation is (a) the movie file was in fact less than 1GB, (b) the USB stick was secretly larger than 1GB as stated, or (c) the movie file was copy-pasted only partially and the owner did not notice.

4
  • Survey says: b. However I'm not an expert here so that is all I can say :) – Conor Mancone Aug 20 '20 at 22:34
  • Note that most of the long-running "secure" erase utilities are filling the drive with meaningless data - usually all 0s, or possibly random values. It used to be that for traditional magnetic harddrives you needed multiple passes, but this is no longer the case (and I think was never the case for flash memory?). b is true - internal to the drive, though, and not generally accessible (ie, standard "recover file" utilities can't find it either). Who is the attacker, though? And why isn't a hammer an option for disposal? – Clockwork-Muse Aug 20 '20 at 23:28
  • Isn't there the option to physically destroy the USB too? – Jim Aug 21 '20 at 12:42
  • @Clockwork-Muse (and at Jim) Well, sure, the hammer and physically destroying the stick is always an option, but the idea is why resolve to that when you can guaranteed render it useless programmatically? – initiation14695 Aug 23 '20 at 8:52
4

There was a worry that hard-discs (of an appropriate vintage now) would be vulnerable to having overwritten bit read. Rebutted here: https://www.nber.org/sys-admin/overwritten-data-guttman.html

Therefore schemes were devised to do multiple passes overwriting the data enough times and randomly so that no future development could extract data.

For a USB stick the main risk is probably 'bad blocks' - where the original data is preserved read-only, because the re-write failed. In this case it doesn't matter how many times or how cleverly you over-write it; someone who can dismantle the drive and read the flash directly can extract (some of) your original data. Drives handle bad-blocks by over-provisioning - the stick has more space than is exposed to the operating system, and remaps bad-blocks to the reserved space when they fail. Flash tends to fail read-only (i.e. fail on write), so the old data is present, if an attacker reads the flash directly.

3
  • If I understand your answer correctly though the approach that the OP suggests would work as good as those other tools since they wouldn't be able to overwrite those 'bad blocks' right? Then what is the solution? To physically destroy it? – Jim Aug 21 '20 at 12:41
  • @Douglas Leeder That's interesting. So, basically, in my scenario, ~100MB of the sensitive files could have been “trapped” as read-only bad blocks and only ~900MB of the movie file were successfully copied (i.e., with no failure/corruption involved). In that case, can I not simply run a hash checksum to make sure the entire 1GB of the movie file was copied intact? And after that explicitly know that all sensitive files are now gone? (How else would a 1GB movie file fit in a 1GB stick?) – initiation14695 Aug 23 '20 at 9:11
  • 3
    @initiation14695 - No, because of over-provisioning. USB sticks have some additional space because of bad writes (say, 1.2 GB in this scenario). So from the OS (and your) perspective, you actually have written the entire file, and can play it back (or get the hash) just fine. – Clockwork-Muse Aug 24 '20 at 15:15
3

Well, it depends a bit on what flash drive is used. In general, flashdrives (and SSDs for that matter) use wear-leveling and over-provisioning. So, if you're using expensive, industrial grade flash drives (f.e. Delkin) you have some over-provisioning (more storage than advertised). Consumer-grade flashdrives generally do not have much over-provisioning.

Of course, if the movie was less than the storage-size or if the copying was incomplete, that would explain the possible retrieval.

In the old days, even up to the 5 Meg hard drive (e.g. IBM 2314), head alignment on the hard drive was not as precise at it is now. That meant that, with more precise control hardware (yes: change the controlling hardware) and some luck, you could retrieve some of the bits that were overwritten, reading a bit to the side of the track. Doing a 5 or 6 pass write over them in general made the retrieval of the original bit impossible. Many safe-erase utilities still think like they're in that era.

2

If it falls into the wrong hands, can any of the sensitive files (that filled the stick before the movie file was pasted) be retrieved?

Possibly, yes, but not because your idea of copying files is any less secure than using the software tools. There may be data that was previously written to now bad sectors or "hidden" storage space on the drive which neither your copying of files, nor the software tools, can overwrite.

As for your other question:

Why do complex hard drive erase utilities exist? Some of them feature “safe” erase procedures that take houuurs, when simply filling a soon to be discarded HD with meaningless files, can do the job?

There are multiple reasons, and they still have some (perhaps limited) value:

  1. A single pass wipe is probably easier and faster than your proposal. With your idea you need to find enough data to exactly fill up the space on the drive. If your files are too big it could fail, or too small and you may leave some space untouched at the end of the drive. A utility can do a single pass quickly without this problem.
  2. Some companies must follow outdated standards that require multiple passes for a secure wipe. They need to do this even though they know it isn't necessary, simply until the compliance rules are updated.
  3. There's a chance that very old hard drives do have some amount of memory after a single wipe, and out of an abundance of caution it doesn't hurt to do multiple passes.
  4. For paid products with a warranty and insurance, a company can lean on that for reassurance that they are protected if something goes wrong with the software.

But given that some sectors may not be overwritten by the security tools either, for extremely high security data, complete physical drive destruction is still used.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.