Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I heard some people mention that files are deleted from flash drive for good, there is no tracing back. Is that really true?

If not, how do I permanently delete files from it? I have a sensitive file on a flash drive and before passing the flash drive around, I want to make sure nobody will be able to see that file.

share|improve this question
19  
FLash drives are cheap, if it is that sensitive, don't pass it around. Why take chances? –  JonnyBoats Dec 26 '11 at 22:13
1  
@JonnyBoats I plan to use this flash drive at home, but it's very possible one of the family members give it to somebody else accidentally. I just wanted to be safe. –  TPR Dec 27 '11 at 1:27
    
Unless people are going to access the chips directly, overwriting once may be good enough. Some drive have "spare" cells they swap in to level wear and to replace bad cells. So over write more than once may get the space cells. In the future I would suggest encryption with a strong password then deleting/formatting may be enough. –  Scott McClenning Dec 28 '11 at 23:07
    
All you really need to do is erase everything, fill it up with junk, and then erase again. The odds of anything significant remaining would be vanishingly small, and would take black helicopters to recover. –  Daniel R Hicks Feb 6 '13 at 23:58
add comment

14 Answers

The best delete tool that (little) money can buy:

enter image description here

EDIT: To counter the detractors

  1. No one mentioned the need for government level security, so arguments with that objective are pointless goalpost shifts. This is good enough for anyone who isn't James Bond or Bruce Wayne. P.S. Governments sanction shredders. What is a hammer but a high velocity shredder?
  2. Of course you need to bust up the storage chips within the thumbdrive. I thought that went without saying.
    • "Doctor, I got that bottle of pills from you but they did nothing!"
    • "Did you take the pills out of the bottle."
    • "No."
    • ಠ_ಠ

Furthermore, I did include instruction on how to do a thorough logical wipe of the thumbdrive.

END EDIT

Don't take chances. Flash drives are cheap and yes, data can be recovered from them. I've done it myself. You could DBAN it. You could also cipher /w a few times on a Windows machine (dd if=/dev/zero bs=2048 of=/mnt/disk/file on a *NIX machine). However, hitting things with a hammer is so much more fun and permanent.

share|improve this answer
7  
@ppumkin: I wouldn't trust such "BIOS IMPLEMENTED LOW LEVEL FORMAT"s for flash drives. Flash based media such as flash drives and SSDs have something called "wear-leveling" which happens at the hardware level. How to securely wipe data from such media is still an open question. Physical destruction is the only way to be sure. –  Scott Pack Dec 27 '11 at 20:27
3  
+1 for Hammer Time! –  CharlieRB Dec 27 '11 at 21:46
6  
@ppumkin: The Low Level Format that you're talking about was pretty much non-existent by late '90s for end-users. Some manufacturers do have their own tools which can do something similar (such as Seagate's SeaTools). However they were designed to work with the automagic bad sector recovery of magnetic disks. These days you're not likely to see an old school LLF outside of the factory. –  Scott Pack Dec 28 '11 at 21:31
3  
@ppumkin The ATA command 0x50 (Format Sectors) doesn't actually format anything anymore (not since the mid-90s at best). On platter drives the command is implemented as ATA command 0xC0 (Erase Sectors). On flash media it usually only marks the block as free, it commonly doesn't erase the contents of the block. Further USB drives use the SCSI command set, and the SCSI command 0x04 only ensures that the disk is formatted and that a standard read command will return 0s. It does not force the drive to format (if that were even possible) and does not guarantee the actually erasure of the media –  Chris S Dec 29 '11 at 20:44
4  
Worth knowing that on drives using perpendicular storage a single pass wipe is identical to multiple. –  Chopper3 Dec 29 '11 at 21:01
show 16 more comments

It depends on who your adversary is. If it is a casual user, e.g. friend/coworker/spouse/etc., then preventing regular undelete is good enough: format the flash drive, then fill it with random/non-private files till it's 100% full, then format the flash drive again. Your original sensitive data will be gone for good, and unrecoverable using undelete tools or direct scan of the drive.

However, if your adversary is a major corporation, government, etc., then the only safe course is to destroy the media physically, e.g. burn your flash drive in a high-temperature industrial oven.

share|improve this answer
    
For casual users, just deleting the files normally is sufficient - most of them don't even realize files can be undeleted. And destroying a perfectly good flash drive (as with @Wesley's answer) because you are afraid your Great Aunt Sue is going to figure out how to access the raw wear-leveled data to recover your dirty photos is paranoid to an unhealthy level. –  BlueRaja Dec 28 '11 at 0:35
2  
@BlueRaja: For a casual user, undelete is at the far end of "how to restore deleted photo" google query... Certainly within reach of Great Aunt Sue. And as I said, destroying your media physically is only needed if your adversary is very well-funded and resourceful. –  haimg Dec 28 '11 at 1:03
    
"Your original sensitive data will be gone for good...", "However, if your adversary is..." You mean it's not gone for good? are you sure you know what you're talking about? –  Matt H Jan 10 '13 at 4:15
add comment

There's an excellent free open-source program called Eraser that removes data by overwriting it with your choice of data patterns - high level security for data erasure.

But - there is a big issue with flash drives when erasing by overwriting. The problem is the "wear leveling" methods used on solid state drives, which writes in a different place each time you add or replace data. There is a full explanation and discussion at Erasing USB key Drives

The short answer - erase the file but also use the "erase open space" function in the Eraser program. This overwrites all unused space, including the earlier version of your file.

share|improve this answer
3  
+1 for eraser.heidi.ie on Windows. –  Nick Josevski Dec 27 '11 at 5:36
add comment

Use shred.

shred /dev/sdx -n 25 

should clean your drive well.

share|improve this answer
    
It will, because when the drive gets full, it will be forced to write at every location. –  Loke Dec 28 '11 at 5:15
add comment

Because of wear leveling of modern flash devices, it's not under your control. You think you've overwritten your data 25 times, it may still be there. If you want to store sensitive data on a flash device, use an encrypted container like truecrypt, so you won't be in trouble when you lose the device (unless you give away the key).

share|improve this answer
add comment

If you want to absolutely sure that nobody will be handling the drive again, a generous application of suspect liquid to the circuit board should take care of both the data on the chips and prevent people from handling it.

share|improve this answer
add comment

I heard some people mention that files are deleted from flash drive for good, there is no tracing back. Is that really true?

NO, A Files start with a bit referred to as a flag. When you delete a file,what you are doing is actually setting the flag off, which tells the computer that the space is now free to hold new data.

If you really want to destroy the data on a disk, you need to repeatedly overwrite the data with a random mixture of 0's an 1's. Just doing a format won't work because someone with the proper sniffing hardware & software can restore and reset the flags so the data can be read.

  1. One way you can do this without anyone's help is, write_data - delete_data - write_data - delete_data - write_data - delete_data :) (ensure every bit of the drive gets written to, and that what you write is sufficiently random)

  2. Use a file shredder , Google it and you'll get many free file shredders, if you have bit-defender, I've seen file shredder in-built in that.

share|improve this answer
1  
Just write data - delete data is a bit simple: you need to ensure every bit of the drive gets written to, and that what you write is sufficiently random, else there might still be ways to detect what data used to be there. –  Konerak Dec 27 '11 at 15:17
    
@Konerak edited the answer to include your points too :) –  COD3BOY Dec 27 '11 at 15:32
add comment

I plan to use this flash drive at home, but it's very possible one of the family members give it to somebody else accidentally. I just wanted to be safe. – progtick

In that case, you won't have the chance to delete the files beforehand anyways.

Just encrypt your files, and don't worry about deleting them if the drive is ever lost - no one will be able access them without the password.

share|improve this answer
    
no, I already know what files I need to delete. I dont usually put sensitive files on flash-drive anyway, but somebody in family did. I dont want to know throw away the flash-drive yet, since we are primarily using it at home, so I just wanted to delete the particular files. –  TPR Dec 28 '11 at 0:50
add comment

System Mechanic has a tool called Incinerator which does exactly what you are asking for.

share|improve this answer
add comment

Depends. If you just want to make sure noone can recover the data with regular file recovery/carving tools: Overwrite the flash drive with random data using linux (dd if=/dev/urandom/ ... or the already mentioned shred). Alternatively, if you have no such tools available, format it (this will destroy the metadata), then fill completely with irrelevant data, then format again. This is less reliable than the proper, tool-assisted method, but should be sufficient for data of low sensitivity.

If you want to delete an individual file (unreliable, not recommended), rename it to a random name, then delete it, then fill the drive completely with irrelevant data.

These methods will not reliably prevent recovery that involves hardware manipulation ("laboratory attack"). If the data is so sensitive that you want to avoid this risk, follow the NIST Guidelines for purging flash-based media:

Purging: See Physical Destruction.

Physical destruction: Destroy media in order of recommendations.

  • Shred.
  • Disintegrate.
  • Pulverize.
  • Incinerate by burning in a licensed incinerator.
share|improve this answer
add comment

I heard some people mention that files are deleted from flash drive for good, there is no tracing back. Is that really true?

Yes and no; it depends on your definition of “gone for good”.

What they were likely talking about was that deleting a file from a flash-drive is always equivalent to holding ⇧ Shift when deleting the file.

This is because Windows only puts a Recycle Bin on fixed volumes like hard-drives, not removable volumes like flash-drives, memory cards, floppy disks, packet-writing CD+RWs, network drives, or substituted drive letters (even ones mapped to fixed-disks). Therefore, if you delete a file in Windows from a hard-drive with just Del instead of ⇧ Shift+Del, you should be able to restore it from the Recycle Bin, but deleting a file from a removable media with Del is the same as using ⇧ Shift+Del to permanently delete it since it has no Recycle Bin.

However, for performance reasons, permanently deleting a file doesn’t actually delete the file. Instead, the system only marks it as deleted and its disk-space as free for use by new files. Until its clusters are overwritten by other files, it can theoretically be recovered, and if there is a lot of free space, then it could take a while before it gets overwritten—of course if you are actually trying to recover an accidentally deleted file, it is likely to immediately overwritten even with plenty of free space (ಠ_ಠ).

If not, how do I permanently delete files from it? I have a sensitive file on a flash drive and before passing the flash drive around, I want to make sure nobody will be able to see that file.

Use a secure-deletion tool. They will overwrite the file before deleting it. The better ones also delete the directory entry to wipe out even its filename and the best will even overwrite its meta-data like its size and timestamp. Some can also wipe existing free space which can be handy to wipe previously deleted files, however it can take a while if there is a lot of free space since it is writing to every byte of that space, e.g., wiping a drive with 300GB of free space is like creating a 300GB file. Most provide one or more techniques like different patterns of bytes to overwrite with and number of repetitions.

share|improve this answer
add comment

If your drive supports one of these commands, you're in luck:

sg_sanitize - remove all user data from disk with SCSI SANITIZE command

or similar commands to hdparm:

   hdparm --security-erase PWD
          Erase  (locked) drive, using password PWD (DANGEROUS).  Password
          is given as an ASCII string and is padded with NULs to reach  32
          bytes.   Use  the  special  password  NULL to represent an empty
          password.  The applicable drive password is  selected  with  the
          --user-master  switch  (default  is  "user" password).  No other
          options are permitted on the command line with this one.

   hdparm --security-erase-enhanced PWD
          Enhanced erase (locked) drive, using password  PWD  (DANGEROUS).
          Password  is given as an ASCII string and is padded with NULs to
          reach 32 bytes.  The applicable drive password is selected  with
          the --user-master switch (default is "user" password).  No other
          options are permitted on the command line with this one.
share|improve this answer
add comment

If physical destruction is warranted I would go for an angle grinder - a cheaply available tool. Hold the piece with a pair of pliers against the rotating disc until the chip is consumed.

Sometimes the flash drive is damaged and you can't delete/overwrite data on it and you just want to destroy it before disposing of it.

Note: wear eye protection in case the piece flicks off.

share|improve this answer
add comment

Here's a method I've cooked up after reading all these answers.

  1. Delete the target folder/file.
  2. Find a safe file that is just under 100 MB in size
  3. Create a folder called erase1 and place it there.
  4. Find out the amount of remaining free file space, divide this by three and then figure out how many 100 MB files should safely fill it.
  5. Copy and paste your safe file in erase1 untill you've reached this 1/3 number, so you now you have a folder with roughly one third free space now occupied in it by a bunch of safe 100 MB files...
  6. Copy this folder and call it erase2, and then try copying it again to erase3.
    If you can't fill up the remaining space, remove a few 100 MB safe files until erase2 copies to erase3.
  7. Delete erase2, copy erase3 and call it erase2a.
  8. Delete erase3, copy erase2a and call it erase3a.
  9. Delete erase2a and erase3a.
  10. Copy erase1 to erase1a.
  11. Delete erase1.
  12. Start the process over again

    1. So, copy erase1a to erase2b
    2. Delete the same number of 100 MB files as before
    3. Copy erase2b to erase3b.
    4. Delete erase2b
    5. Copy erase3b to erase2c.
    6. Delete erase3b
    7. Copy erase2c to erase3c.
    8. Delete erase2c and erase3c.
    9. Copy erase1a to erase1b and delete erase1a.

You could go it again, but probably two times is safe, delete the remaining erase1b folder and you should have overwritten everything in the open region of the flash drive.

Crude method, but if you only need to do it once it should work I think. Any comments out there?

share|improve this answer
5  
"Any comments out there?" Just one. Yikes. –  thirtythreeforty Jan 10 '13 at 4:13
1  
Can you clean this post up? I would but I'm afraid. –  slm Jan 10 '13 at 5:27
    
nice try Great Aunt Sue –  danjp Jan 10 '13 at 5:33
    
Why would any person do this? CCleaner a free tool can do what this process does automatically. Besides this process doesn't make it impossible to recovery the files. –  Ramhound Feb 5 '13 at 12:47
    
Find a safe file that is just under 100 MB in size Define “safe”. Would a blank file (e.g., filled with nulls) be safe? Not really; an NTFS volume with encryption would compress it and leave the free space unaffected. The same goes if the file is created as a sparse file. Unfortunately, things are not as simple as they were in teh old FAT days when you could easily and manually ensure things were clean with a low-level disk editor in DOS. –  Synetech Feb 6 '13 at 22:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.