±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 2
Overall: 26790
Visitors: 55

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

What´s the best way for cleaning flash drives?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

What´s the best way for cleaning flash drives?

Post Posted: Wed Aug 07, 2013 12:17 pm

Due to ' Wear Leveling' what is the best way for safely cleaning all types of flash drives, flash cards etc? I suppose in this case more tan one pass are needed.  

electronic_x
Member
 
 
  

Re: What´s the best way for cleaning flash drives?

Post Posted: Wed Aug 07, 2013 1:45 pm

- electronic_x
Due to ' Wear Leveling' what is the best way for safely cleaning all types of flash drives, flash cards etc? I suppose in this case more tan one pass are needed.


Actually not really.

It is something on which there are many theories, but if you want "safe", right now you need to destroy them physically OR use the specific controller manufacturer's "Mass Produiction" tool to completely wipe the flash memory(ies).
But even these tools may not be enough, since what a weared down area does is to "retain" previously written information i.e. the controller is not being able to write there the new info (or not completely/exactly).

As a matter of fact by making several passes it is possible that more spare sectors get used (and thus more of the previously written ones and "worn down" remain on the stick though not accessible easily).

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: What´s the best way for cleaning flash drives?

Post Posted: Wed Aug 07, 2013 1:55 pm

I second the destroy. Shred then burn.

If you are bored and have nothing better to do, I can tell you how you could use microprobes and wipe the memory individually, including the spare areas, ECC, and such...

But, expect to spend more money on the tools, than purchasing a new device - even if it is a SSD.  

jhup
Senior Member
 
 
  

Re: What´s the best way for cleaning flash drives?

Post Posted: Wed Aug 07, 2013 4:15 pm

a)Some time ago I read an article supporting the idea that not accesible areas would be increasingly overwritten the more higher number of passes were performed. So, that idea is not correct?

b)On the other hand, I have read an article on Kingston website. The autor supports the idea that HDDERASE(or any other similar tool??) can sucesfully perfom the ATA command on external flash drives. Have I correctly understood the article, and is the autor correct about this?

www.kingston.com/us/co...ticleid=10


c) BTW, although I know my question is naive but I´d like to know: me and a friend, PC technician, tried file recovering on a USB pendrive after 7 passes. We used recuva and Encase. Nothing was recovered. How, then can wear leveling áreas recovered?


d) If absolutely NO other way to get rif of old remnant data in flash devices: jhuo has mentioned 'burning' but Are chips, madeof silicon, affected by fire?  

electronic_x
Member
 
 
  

Re: What´s the best way for cleaning flash drives?

Post Posted: Thu Aug 08, 2013 1:15 am

- electronic_x
a)Some time ago I read an article supporting the idea that not accesible areas would be increasingly overwritten the more higher number of passes were performed. So, that idea is not correct?


It probably is -- for an identified sector. The more writes, the greater the likelihood that that sector (or the area in which that sector is located) will die.

But you're not interested in one single sector, you are interested in all of them. That means not only those that can be accessed through the host interface, but those that cannot. And you are also interested in the information stored in those sectors, and how that is moved during the lifetime of the device.

It's not a bad idea to consider a storage device a black box that works as if it was a ATA-compatible drive, but may be up to all kind of additional tricks behind the curtains. (Like those Xerox copiers that Soviet embassies used for copying their secret documents.)


b)On the other hand, I have read an article on Kingston website. The autor supports the idea that HDDERASE(or any other similar tool??) can sucesfully perfom the ATA command on external flash drives. Have I correctly understood the article, and is the autor correct about this?


As long as you stick to that exact make of Kingston SSD, why not? But if you're dealing with Intel, you may have a look at this. www . iishacks . com/2009/06/30/how-to-secure-erase-reset-an-intel-solid-state-drive-ssd/

And there are random indications that some devices don't really do a full erase, but just report that it has been done.

I hope you realise that you need to cope with *all* eventualities, including those of drives that worked fine for some time, but then locked up completely, and won't respond anymore. How do you ensure that any information that remains in them is destroyed?

The emphasis is probably: How do *you* ensure that any information that remains in them is destroyed? Taking all eventualities into consideration.

Me, I'd go for physical destruction. Even then, I'd probably keep the remains in a safe for a year or two -- because sooner or later someone will ask me how I really can be sure.

If your security requirements are lower, you may ben able to go for other solutions. Make sure you document your decision. Sooner or later, you will need to defend it.  

athulin
Senior Member
 
 
  

Re: What´s the best way for cleaning flash drives?

Post Posted: Thu Aug 08, 2013 6:29 am

You may also want to take a step back and think about the risk to cost ratio.

What is the risk level, and likelihood that someone else will be able to extract information from areas you cannot get to?

What is the cost associated with you wiping that area?

Is the risk less costly than the cost of wiping everything?

That is, your cost of wiping user accessible areas is minimal.
Running special TRIM commands, if the device accepts them, and not verify is minimal.
Destroying the device is more expensive as you have to replace it.
Running special TRIM commands, if the device accepts them, and verify the result will require you to spin up a small lab.
Find some OCD and attempt to rewrite non-volatile memory will need an other type of lab.
Rewrite ICs manually than putting them back on, even more lab...

So what is the "cost" of your risk? Remember you can get a +500GB SSD for less than $300.

You will be hard pressed to ramp up a a small lab to verify that a TRIM command worked on even the over-provisioning areas. Same for manually wiping the chips.

Might be slightly less if you can work with on-chip debugger.  

jhup
Senior Member
 
 
  

Re: What´s the best way for cleaning flash drives?

Post Posted: Thu Aug 08, 2013 6:44 am

The article you linked to on Kingston is ONLY about SSD drives (with a ATA interface) AND the validity of the theory has been debunked by practical experiments.
Read:
www.forensicfocus.com/...ic/t=9847/
articles.forensicfocus...-about-it/
www.usenix.org/legacy/...rs/Wei.pdf

The issue here is that seemingly a number of manufacturer have not implemented correctly the ATA standard for Safeerase.

About flash drives (USB sticks) you can always do a chip off, and read memory directly (IF you know how to do that - NOT easy but doable).
JFYI:
flash-extractor.com/
www.forensicfocus.com/...ic/t=7042/

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 3
Go to page 1, 2, 3  Next