33

My company has issued an encrypted USB flash drive which I stored my personal data in it. I am resigning from the company and I wanted to wipe the data in the usb drive but I have forgotten the password.

I tried using dban and nuke to wipe the data but it is an unrecognised device shown in dban.

The USB flash drive comes with an EXE program which I need to enter a password before the drive can be mounted.

How do I remove my personal data in the encrypted USB flash drive?

Updates

  1. I tried gpart and the disk couldnt be found
  2. I tried diskpart and the disk was 0 bytes, neither can I find any partition or able to clean it.
  3. I did a live ubuntu cd boot and the usb thumb drive was detected as a cd-rom

There is no way of wiping the data and I have returned the device and trust the sysadmin to have integrity of wiping the device.

Lesson learnt: Never store your personal data on company device.

  • 21
    Do you know how to use Linux, or boot up a live CD? Linux's tools (such as GParted) will certainly not fail to delete the partition. – jehad Jun 26 '16 at 11:15
  • 4
    You can use a fire, that always works. Flash drives are like cheap, just buy another one. In the future, there might always be a new way of reading private data. tin-foil-hat-security – noɥʇʎԀʎzɐɹƆ Jun 26 '16 at 20:16
  • 9
    ... and this is one reason why you do not store or transmit personal bits on or across company property. – Eric Towers Jun 27 '16 at 7:10
  • 11
    If you have forgotten the password, it's obviously something you don't normally use in the line of your job. If it's not, the company should not be surprised if employees misplace these small devices. I'm not suggesting that you accidentally misplace it but.. – pipe Jun 27 '16 at 11:05
  • 6
    I see some people telling you to reformat and then write zeros to the disk using dd. I just want to warn that if you specify the wrong device with dd (e.g. sdb instead of sdc or something depending on what your setup looks like) you can do SERIOUS and IRREPPARABLE damage to your actual operating system, so please be careful! – Liam Jun 27 '16 at 18:58

10 Answers 10

72

How do I remove my personal data in the encrypted thumb drive? ... I have forgotten the password … unrecognised device

Crush it to small particles using a large hammer then buy your employer a new one (or ask them to deduct the replacement cost from your wages).

It is always a mistake to store personal data on the property of someone who you do not (or in future might not) wish to have access to your personal data.


A note on overwriting USB devices that use Flash memory.

Formatting any kind of storage device does not completely destroy data, it normally just recreates the filesystem structures without affecting much of the data contents.

For a hard disk, overwriting every data sector once with zeroes (or any character/octet) is sufficient to erase data. However this does not apply to flash-memory based devices such as typical USB memory sticks.

Flash memory devices use a concept known as wear-levelling, this means that some areas of storage will be rotated out of use and will not normally be accessible when using normal filesystem operations like writing a file. This makes erasing these devices more complicated. You need to make sure that any erasure tool you use is designed to work with devices that use wear-levelling.


A note on encrypted USB drives

I have an old Sandisk Cruzer device that uses the infamous U3 encryption system. When you first plug this in, all your computer sees is a small "CD-ROM" device that contains the U3 software and an autorun file. The encrypted data is in a non-visible "device" that the computer cannot see.

Only when you enter the password into the U3 software does the software make the encrypted device visible to the computer - which then assigns it a separate drive-letter (in the case of Windows) to that assigned to the pseudo-CD-ROM.

So if you don't enter the password, your computer cannot see the encrypted storage at all. Therefore no recovery/formatting/overwriting software can help.

U3 has some security weaknesses which allow you to bypass the password (Google will find this) but it is likely your device is better than U3.


A note on corporate USB drives.

Large serious companies that take security seriously are likely to purchase devices that can be centrally managed. Part of this is making provision for lost passwords by having a separate administrative password that can allow an administrator to regain full access to a device where the user's personal password has been lost.

This means that, just because you have forgotten the password, it doesn't mean a corporate administrator can't gain access to the data secured on the device.


A note on professionalism.

I would give some consideration to explaining the situation to your employer and working with them to resolve the issue to mutual satisfaction. This would be the "right" thing to do.

However, having stored personal data on a corporate resource, I sense that you are now looking for a solution that doesn't take corporate ethics and professionalism as a key point of reference.


A note about Rottweilers.

All in all, someone might regard it as a lucky blessing unfortunate minor disaster if their sister's Rottweiler chewed the device up and crushed the storage chips inside before they could rescue it. Make sure that doesn't happen to you.

If that happened to me, I'd offer to pay my employer the costs (hardware and administrative) to them caused by my foolish carelessness. Taking responsibility for their actions and paying for mistakes is something that adults are expected to do.

  • 2
    Yes, I made a mistake and I had learnt my lesson. They might inflate the cost and charge some administrative fees, which I have no reasons to pay for. I am looking to wipe/destroy the data. – ilovetolearn Jun 26 '16 at 12:28
  • 7
    The smaller the pieces get, the better. One way to do it: youtube.com/watch?v=y2eNhPC8wCQ – asdmin Jun 26 '16 at 18:33
  • 3
    But if pieces are too small, accidental breath is possible. And I don't think that's much healthy. Same for burning gases. – Oriol Jun 26 '16 at 21:59
  • 4
    This shouldn't be done without the company's consent, though. And many company's register every hardware's serial number. – phresnel Jun 26 '16 at 22:35
  • 6
    Alternatively, he could just tell them company he lost it and not get into the details of destroying it. He may still have to pay for the loss, of course. @asdmin Are you sure that won't damage the blender? They're not designed for solid, hard, metalic items. – jpmc26 Jun 27 '16 at 4:08
13

As @jehad mentioned, use gparted utility. It is an open-source utility for disk managment, supporting a bunch of file systems.

You didn't mention what OS are you using — for most of them you can get it with package manager. Otherwise, you can download Live CD, burn it to a disk, and boot from it.

There's a few possible ways to get rid of the data — one of them is to just remove the partition with gparted, and create a new empty one. Note, that theoretically it is still possible to restore the data, in this case you can use something like dd utility, but you have to mention specifically if that's the case.

  • I am using Windows 10. – ilovetolearn Jun 26 '16 at 12:27
  • @optimus well, then you have to download a LiveCD, and boot from there. The image ≈300 Mb, as I recall. – Hi-Angel Jun 26 '16 at 12:29
  • 3
    You'll need to identify the device file on your system. To to that, run the command df before and after plugging it in. The new line that appears for the second run is your thumb drive. It will be something like /dev/sdc. To use dd as Hi-Angel suggested, the syntax is dd if=/dev/urandom of=/dev/sdX where sdX is the device file that you identified earlier. – picobit Jun 26 '16 at 18:06
  • 1
    Usually, when someon mentions .EXE files, it's a windows platform :D – DaMachk Jun 27 '16 at 9:11
  • 1
    There's no reason to believe that the device will show up as a USB block device before running the proprietary unlocking tool. – pipe Jun 27 '16 at 11:02
7

Since you're using Windows 10, you might be able to use DiskPart, depending on how the encryption works. If the flash drive doesn't even present the encrypted partition's storage space to the OS without unlocking it via some special low-level mechanism, then the only thing you can do is physical destruction, but this might help somebody:

  1. Run diskpart.
  2. Type list disk to see the disks available to Windows.
  3. Type select disk N, where N is the number of the flash drive, e.g. select disk 2 if it was listed as Disk 2 in the previous step. Danger! Be very careful that you get the right drive, otherwise you'll blow away something important in the next step.
  4. Type clean all to scribble over every sector of the drive with zeroes. If your data destroyer can handle the drive now, you can stop following these steps. If it needs a normal volume, read on.
  5. Do list disk again to see the amount of free space the drive now has.
  6. Run create partition primary size=N where N is the free space in megabytes.
  7. Type list partition to see the ID of the new partition (it's probably 1).
  8. Type select partition N where N is the partition number you just got.
  9. Type format fs=ntfs quick to create a new NTFS volume.
  10. Exit DiskPart with exit.
  11. Use your data destroyer of choice to obliterate any chance of recovering the data that was under the space now occupied by this new partition.
  • I repartioned office pen drive using this. Pen drive was not encrypted but have many hidden partions created. – devprashant Jun 27 '16 at 0:57
  • actually it can be done in GUI using diskmgmt.msc – phuclv Jun 27 '16 at 7:51
6

The thumb drive comes with an EXE program which I need to enter a password before the drive can be mounted.

If it is just an .exe file that auto-runs on startup, just arrange a Linux PC (or download -- it's free) from someone and format. Wine can run .exe files fairly well.

  • @optimus Linux can't rune exe - and you can always delete the exe program. I think you have misunderstood how the thumb drive works. You can also use VMWare. – noɥʇʎԀʎzɐɹƆ Jun 26 '16 at 20:18
  • 8
    @CrazyPython The point isn't to run the exe, the point is to format the volume that contains the encrypted data. – fluffy Jun 27 '16 at 5:37
3

If is a dedicated drive, you may try a few runs of:

cat /dev/urandom > /dev/usbdevicetowipe

...issued from a Linux live CD of your choice.

It may take a while if the drive is big, but you will get a wiped drive.

  • 2
    Doesn't dd if=/dev/urandom of=/dev/usbxxx seem like a considerably better choice than cat? – oldmud0 Jun 26 '16 at 17:24
  • I don't think so. There are answers on SE network explaining differences of cat vs dd but for such a simple task they are not relevant. Anyway I prefer to use cat because I find the syntax easier to remember... – Paolo Jun 26 '16 at 17:30
  • 1
    There is more than one way to spin a cat. – user488805 Jun 27 '16 at 18:08
  • To add to your answer, unplug all other USB flash drives to narrow the results and use ls -l /dev/disk/by-uuid/ or ls -l /dev/disk/by-id/ to see which dev file is associated with the USB drive. – user38537 Jun 28 '16 at 7:42
  • Or run lsblk. – gerrit Jun 28 '16 at 16:06
3

IMHO there's no need for a Linux disk or similar. If you can see the Exe on the USB stick, the USB stick has already been mounted.

In that case you can:

  1. Go into Windows' disk partition management (diskmgmt.msc)
  2. Delete all partitions on the USB stick (there might be some without drive letter)
  3. Create a new single partition that uses all USB disk space
  4. Use SDelete -z to wipe all disk space

Due to the nature of Flash memory, some data may remain on the disk, but if I understood you correctly, the data was encrypted anyway, so there should not be something that can be recovered.

3

At the company I work at, we use similar encrypted USB keys to transfer data. The drive contains a partition which presents itself as being an optical drive. This partition contains the executable files to decrypt and mount the second encrypted "data" partition to the system.

The software included on our USB keys has a 'forgot password' functionality, which wipes the data off the data partition.
I suppose that the tool actually changes the encryption keys used to decrypt the data partition, making the data irretrievable for anyone who didn't know the private encryption key of the data partition.

Check whether your key's software has an option to flash the drive or to reset the password.
Actually, as long as your company doesn't know the passphrase used to unlock the decryption (private) key or the decryption key itself, there's no risk of the company being able to extract your data from the key (unless the encryption scheme is really weak and trivially reversible, which would defy the purpose of those encrypted keys).

Maybe you could edit your post to include some information on the process you would have to go through to access the data on your key, if you did remember the password.

  • How is the USB key presented to the host? Does it act like an optical drive, like mine?
  • How do you open the tool to decrypt the key?
  • Where/When do you need to enter the passphrase?
  • Is the decrypted drive mounted as a new USB drive, or is it browseable through some sort of software?
  • ...
  • 1
    +1 Pretty much all the USB disks that have an EXE on a CDFS partition, that I've used, have exactly this... a "Forgotten password" function that securely wipes the disk and presents you with the ability to start again and enter a new password as if the disk were new. – Kinnectus Jun 28 '16 at 13:14
  • yes, it works like a cd-rom drive, after entering the password, the disk drive appears – ilovetolearn Jun 29 '16 at 13:37
2

What type of disk? If it's like an IronKey, where the drive renders itself unreadable after a number of failed attempts, you can just enter an incorrect password enough times to trigger the self-destruct mechanism.

If it's just a standard encrypted drive, one where you chose the encryption password and no other password will unlock it, no problem. If you don't know the password, they don't know it either - so the data on it is secure even if you do turn it in.

If it has multiple passwords (e.g. like my work computer, where more than one user has a password that will unlock the full-disk encryption), in that case (and in that case ONLY) should you consider physically destroying the drive.

1

You could use an utility for magnetic disks (nwipe for example), but the several hidden layers between the USB/SCSI layer and the actual memory cell will prevent making a perfect job.

On top, the reserved area used for wear leveling is only accessible for the wear leveling logic, not for the USB/SCSI layer directly.

To make sure, that you remove all data from a memory technology device, meanwhile you are not in control of the encryption, is unfortunately to physically destroy the device itself.

1

You can explain the situation, refuse to give the disk back, and accept to assume the replacement cost, if any.

Since it is a matter of personal data, you don't need to go into any detail. Simply state you have some personal information on the disk, and therefore are not able to give the disk back.

This is similar to having lost the disk, and the company should be able to deal with the situation.

How this goes depends a lot on the type of relation you maintain with the company and the type of personnel you are dealing with for this.

protected by Community Jul 1 '16 at 23:41

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.