Permanently delete files from a flash drive

Question

I heard some people mention that files are deleted from flash drive for good, there is no tracing back. Is that really true?

If not, how do I permanently delete files from it? I have a sensitive file on a flash drive and before passing the flash drive around, I want to make sure nobody will be able to see that file.

Answer 1

The best delete tool that (little) money can buy:

EDIT: To counter the detractors

1. No one mentioned the need for government level security, so arguments with that objective are pointless goalpost shifts. This is good enough for anyone who isn't James Bond or Bruce Wayne. P.S. Governments sanction shredders. What is a hammer but a high velocity shredder?
2. Of course you need to bust up the storage chips within the thumbdrive. I thought that went without saying.
   • "Doctor, I got that bottle of pills from you but they did nothing!"
   • "Did you take the pills out of the bottle."
   • "No."
   • ಠ_ಠ

Furthermore, I did include instruction on how to do a thorough logical wipe of the thumbdrive.

END EDIT

Don't take chances. Flash drives are cheap and yes, data can be recovered from them. I've done it myself. You could DBAN it. You could also cipher /w a few times on a Windows machine (dd if=/dev/zero bs=2048 of=/mnt/disk/file on a *NIX machine). However, hitting things with a hammer is so much more fun and permanent.

Answer 2

It depends on who your adversary is. If it is a casual user, e.g. friend/coworker/spouse/etc., then preventing regular undelete is good enough: format the flash drive, then fill it with random/non-private files till it's 100% full, then format the flash drive again. Your original sensitive data will be gone for good, and unrecoverable using undelete tools or direct scan of the drive.

However, if your adversary is a major corporation, government, etc., then the only safe course is to destroy the media physically, e.g. burn your flash drive in a high-temperature industrial oven.

Answer 3

There's an excellent free open-source program called Eraser that removes data by overwriting it with your choice of data patterns - high level security for data erasure.

But - there is a big issue with flash drives when erasing by overwriting. The problem is the "wear leveling" methods used on solid state drives, which writes in a different place each time you add or replace data. There is a full explanation and discussion at Erasing USB key Drives

The short answer - erase the file but also use the "erase open space" function in the Eraser program. This overwrites all unused space, including the earlier version of your file.

Answer 4

Because of wear leveling of modern flash devices, it's not under your control. You think you've overwritten your data 25 times, it may still be there. If you want to store sensitive data on a flash device, use an encrypted container like truecrypt, so you won't be in trouble when you lose the device (unless you give away the key).

Answer 5

Use shred.

shred /dev/sdx -n 25 

should clean your drive well.

Answer 6

I heard some people mention that files are deleted from flash drive for good, there is no tracing back. Is that really true?

NO, A Files start with a bit referred to as a flag. When you delete a file,what you are doing is actually setting the flag off, which tells the computer that the space is now free to hold new data.

If you really want to destroy the data on a disk, you need to repeatedly overwrite the data with a random mixture of 0's an 1's. Just doing a format won't work because someone with the proper sniffing hardware & software can restore and reset the flags so the data can be read.

1. One way you can do this without anyone's help is, write_data - delete_data - write_data - delete_data - write_data - delete_data :) (ensure every bit of the drive gets written to, and that what you write is sufficiently random)

2. Use a file shredder , Google it and you'll get many free file shredders, if you have bit-defender, I've seen file shredder in-built in that.

Answer 7

I plan to use this flash drive at home, but it's very possible one of the family members give it to somebody else accidentally. I just wanted to be safe. – progtick

In that case, you won't have the chance to delete the files beforehand anyways.

Just encrypt your files, and don't worry about deleting them if the drive is ever lost - no one will be able access them without the password.

Answer 8

I heard some people mention that files are deleted from flash drive for good, there is no tracing back. Is that really true?

Yes and no; it depends on your definition of “gone for good”.

What they were likely talking about was that deleting a file from a flash-drive is always equivalent to holding ⇧ Shift when deleting the file.

This is because Windows only puts a Recycle Bin on fixed volumes like hard-drives, not removable volumes like flash-drives, memory cards, floppy disks, packet-writing CD+RWs, network drives, or substituted drive letters (even ones mapped to fixed-disks). Therefore, if you delete a file in Windows from a hard-drive with just Del instead of ⇧ Shift+Del, you should be able to restore it from the Recycle Bin, but deleting a file from a removable media with Del is the same as using ⇧ Shift+Del to permanently delete it since it has no Recycle Bin.

However, for performance reasons, permanently deleting a file doesn’t actually delete the file. Instead, the system only marks it as deleted and its disk-space as free for use by new files. Until its clusters are overwritten by other files, it can theoretically be recovered, and if there is a lot of free space, then it could take a while before it gets overwritten—of course if you are actually trying to recover an accidentally deleted file, it is likely to immediately overwritten even with plenty of free space (ಠ_ಠ).

If not, how do I permanently delete files from it? I have a sensitive file on a flash drive and before passing the flash drive around, I want to make sure nobody will be able to see that file.

Use a secure-deletion tool. They will overwrite the file before deleting it. The better ones also delete the directory entry to wipe out even its filename and the best will even overwrite its meta-data like its size and timestamp. Some can also wipe existing free space which can be handy to wipe previously deleted files, however it can take a while if there is a lot of free space since it is writing to every byte of that space, e.g., wiping a drive with 300GB of free space is like creating a 300GB file. Most provide one or more techniques like different patterns of bytes to overwrite with and number of repetitions.

Answer 9

If you want to absolutely sure that nobody will be handling the drive again, a generous application of suspect liquid to the circuit board should take care of both the data on the chips and prevent people from handling it.

Answer 10

Depends. If you just want to make sure noone can recover the data with regular file recovery/carving tools: Overwrite the flash drive with random data using linux (dd if=/dev/urandom/ ... or the already mentioned shred). Alternatively, if you have no such tools available, format it (this will destroy the metadata), then fill completely with irrelevant data, then format again. This is less reliable than the proper, tool-assisted method, but should be sufficient for data of low sensitivity.

If you want to delete an individual file (unreliable, not recommended), rename it to a random name, then delete it, then fill the drive completely with irrelevant data.

These methods will not reliably prevent recovery that involves hardware manipulation ("laboratory attack"). If the data is so sensitive that you want to avoid this risk, follow the NIST Guidelines for purging flash-based media:

Purging: See Physical Destruction.

Physical destruction: Destroy media in order of recommendations.

• Shred.
• Disintegrate.
• Pulverize.
• Incinerate by burning in a licensed incinerator.

Answer 11

System Mechanic has a tool called Incinerator which does exactly what you are asking for.

Answer 12

If your drive supports one of these commands, you're in luck:

sg_sanitize - remove all user data from disk with SCSI SANITIZE command

or similar commands to hdparm:

   hdparm --security-erase PWD
          Erase  (locked) drive, using password PWD (DANGEROUS).  Password
          is given as an ASCII string and is padded with NULs to reach  32
          bytes.   Use  the  special  password  NULL to represent an empty
          password.  The applicable drive password is  selected  with  the
          --user-master  switch  (default  is  "user" password).  No other
          options are permitted on the command line with this one.

   hdparm --security-erase-enhanced PWD
          Enhanced erase (locked) drive, using password  PWD  (DANGEROUS).
          Password  is given as an ASCII string and is padded with NULs to
          reach 32 bytes.  The applicable drive password is selected  with
          the --user-master switch (default is "user" password).  No other
          options are permitted on the command line with this one.

Answer 13

at the time of frmating unselect the Quick format and start. It will take time but fully delets all the deta an no other recovary app can back it up.

Answer 14

If physical destruction is warranted I would go for an angle grinder - a cheaply available tool. Hold the piece with a pair of pliers against the rotating disc until the chip is consumed.

Sometimes the flash drive is damaged and you can't delete/overwrite data on it and you just want to destroy it before disposing of it.

Note: wear eye protection in case the piece flicks off.

Answer 15

Here's a method I've cooked up after reading all these answers.

1. Delete the target folder/file.
2. Find a safe file that is just under 100 MB in size
3. Create a folder called erase1 and place it there.
4. Find out the amount of remaining free file space, divide this by three and then figure out how many 100 MB files should safely fill it.
5. Copy and paste your safe file in erase1 untill you've reached this 1/3 number, so you now you have a folder with roughly one third free space now occupied in it by a bunch of safe 100 MB files...
6. Copy this folder and call it erase2, and then try copying it again to erase3.
   If you can't fill up the remaining space, remove a few 100 MB safe files until erase2 copies to erase3.
7. Delete erase2, copy erase3 and call it erase2a.
8. Delete erase3, copy erase2a and call it erase3a.
9. Delete erase2a and erase3a.
10. Copy erase1 to erase1a.
11. Delete erase1.

12. Start the process over again

    1. So, copy erase1a to erase2b
    2. Delete the same number of 100 MB files as before
    3. Copy erase2b to erase3b.
    4. Delete erase2b
    5. Copy erase3b to erase2c.
    6. Delete erase3b
    7. Copy erase2c to erase3c.
    8. Delete erase2c and erase3c.
    9. Copy erase1a to erase1b and delete erase1a.

You could go it again, but probably two times is safe, delete the remaining erase1b folder and you should have overwritten everything in the open region of the flash drive.

Crude method, but if you only need to do it once it should work I think. Any comments out there?