Erasing USB key Drives

DavidHB

Active Member
rbeede said:
Is this correct?
In my understanding, entirely.

David
 

Joel

Active Member
Seconded. To further elaborate, new information which I've gleaned indicate that even fully wiping the free space may be insufficient (see "over-provisioning" in SSDs)
 

rbeede

New Member
So any plans to enhance Eraser to handle these situations?

What are the best alternatives to

1. Wipe free space

2. Securely erase a single file while leaving others intact
 

Joel

Active Member
As of now, there isn't a good defence against it. Both scenarios don't bode well for SSD users with over provisioning and block remapping -- the very design of it is meant to ensure that applications don't see the process. Thus, only the manufacturer can release applications to sanitise blocks.

Having said that, if your file is large, block remapping will cause the large file to be scrambled, so the file data may not be as recoverable as it seems. Nonetheless, SSDs have large block sizes (64KB) so if your sensitive data is within 64KB then probably you're out of luck.
 

nesinsula

New Member
Will it work to just format the whole USB stick? Or could someone still easily recover data from it?
On my MP3 player i have recovering software, will it work?

I would be grateful for your help
 

DavidHB

Active Member
nesinsula said:
Will it work to just format the whole USB stick? Or could someone still easily recover data from it?
I'd welcome Joel's views, but I don't think you should apply what he said about SSDs directly to flash (USB) drives. The technology is similar, but there are significant differences; I don't think that USB drives typically have the over-provisioning found in SSDs, and they certainly have smaller block sizes. As far as I know, doing a free space erase on a USB stick will make all the deleted files on it non-recoverable, though it may not remove all the file names.

nesinsula said:
On my MP3 player i have recovering software, will it work?
Try it and see :). Using a file recovery program is the best way for an ordinary user to test an erase.

David
 

nesinsula

New Member
OK, so i should use eraser to remove all the files and free space?
And it will not work to use the formatting (sorry i said "recovery" in the first post) software/firmware(?) on my MP3 player instead?
 

DavidHB

Active Member
nesinsula said:
OK, so i should use eraser to remove all the files and free space?
And it will not work to use the formatting (sorry i said "recovery" in the first post) software/firmware(?) on my MP3 player instead?
If you are clearing the drive completely, I would format it first (if there is a 'quick format' option, that will be fine), then erase the free (that is, all the) space with Eraser. On a flash drive, erasing the files directly will not work.

David
 

nesinsula

New Member
Thanks for your answers. If i use eraser to erase all the free space on my MP3 player, is there a risk of removing the MP3 players software/firmware?
 

DavidHB

Active Member
nesinsula said:
Thanks for your answers. If i use eraser to erase all the free space on my MP3 player, is there a risk of removing the MP3 players software/firmware?
In principle, no. But the point to bear in mind is that Windows has to see your MP3 player as a drive, and how it does so will be a function of the player's firmware.

Taking cameras and players I know as indicators, I would expect that formatting the player, or restoring it to factory condition would leave some sort of folder structure which would be visible when the player is mounted as a drive. If that's what you see in Windows, there shouldn't be a problem about erasing the free space. There may of course be space on the player that cannot be accessed as part of the drive, but, as you could never access that directly in any case, that should not be an issue.

David
 

Joel

Active Member
Yes -- but the way flash memory is designed probably means that one pass will render the data irrecoverable (one pass may also be too much for some people.) Modern magnetic drives should have the same behaviour, but because of historic differences (such as the commonly cited Gutmann paper) people still apply multiple passes on hard drives.
 

JoeDoe5

New Member
You can erase it by PHYSICALLY ADRESSING each byte on the device and writing data to each and every single byte on the device.
 

Joel

Active Member
You cannot physically address sectors on a disk from software; the most you can do from software is logically addressing them.

It is the job of the disk firmware to translate logical addresses to physical addresses and AFAIK there isn't a way to physically address them, short of using vendor-proprietary commands (which are proprietary...)
 

garrett01

Administrator
Staff member
Have you tried wiping the drive (Zero it with a freespace erase), saving a new file , erasing that and trying to recover?
Recoverable files are often either old temp files or files still in the recycle bin.
 
Top