1

I am making a series of python scripts for data overwriting. My current prototype creates a series of large files and simply fills the memory (using a different system for additional overwrites). Is there an advantage to overwriting the entire USB after removing all files rather than doing this in terms of protecting against advanced cyber-forensics?

This simple project will be exclusively for USB overwriting so keeping the system running is irrelevant.

By "background data" I mean data that is not currently occupied by another file.

1 Answer 1

0

How does it work?

There are many issues with that simple concept. It worked on HDD because you could specifically tell the drive to go and overwrite a specific sector (or track).

However, with USB type of drives, the data is saved in what in the old days we called EPROM. Today's versions of such are quite different and much better:

  • support many more read/write accesses
  • fast
  • much larger amount of data can be saved in a much smaller space

However, in order to accomplish all of these feats, the drivers were enhance quite a bit. On my good old EPROM, I could write a specific cell (a.k.a. sector). On newer systems, that's not possible. More or less, each time you write, the driver writes the data to a new cell. This is a way to save your cells for as long as possible. You may be able to write 1 million times to one specific cell total before it goes bad. So if the driver automatically writes to the next cell when you update your file, you extend the life of your drive.

What does all of that mean to you?

If you try to write to a specific cell, it may look like you did, but you did not overwrite cells x, x+1, x+3, x+n. Instead you may have written cells x+123, x+25, x+1021, ... the driver keeps tables to know where to write next and it may look pretty random after a while. Since there is no seek time like on HDD, such random access is anyway really fast.

So... as a result, "advance" forensic can find nearly all the data... (okay, maybe 50% of it).

Any Solution?!

Yes. Of course. The manufacturers thought that there could be a need to reset the drive and therefore the driver offers such an option. That reset function has access to the lowest level code which can overwrite all the cells one by one to really delete your data. This is the only way you're going to be able to make it all work.

How to access that command will very much depend on your OS. Most OSes have a graphical interface that will give you access and various software APIs to run the command. You just have to know that it exists so you can look for it.

For Linux

A little while ago, I wrote a page on how to erase an HDD or SDD drive. I have a command like so:

sudo hdparm --user-master u --security-erase "password1" /dev/sdX

Check the hdparm manual for additional info.

2
  • From my understanding, the concept of having a "full" drive is vague on certain type of file systems. However, if your USB is using a form of FAT, it's probably feasible. That is, it should properly make use of all the available sectors before telling you that the drive is full. However, you should probably make sure to write exactly one block at a time to reach the wanted results (i.e. if you try to write 1Mb when there is space for only 512Kb, the "disk full" error may happen early). Jun 28, 2021 at 23:01
  • 1
    It'd be possible on FAT only because FAT is such a simple class of filesystems. More sophisticated filesystems, even if "full", may not actually be full.
    – forest
    Jun 29, 2021 at 2:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .