Is Your Data Gone? Comparing Perceived Effectiveness of Thumb Drive Deletion Methods to Actual Effectiveness

TL;DR

This study compares users' perceived data deletion effectiveness with actual results on USB drives, revealing widespread misconceptions and persistent sensitive data, highlighting the need for better deletion practices and user education.

Contribution

It provides empirical evidence that users' perceptions of deletion methods do not match actual effectiveness, with implications for improving data sanitization practices.

Findings

Over 60% of drives had recoverable sensitive data

No correlation between perceived and actual deletion effectiveness

Market drives show similar deletion issues as buyback drives

Abstract

Previous studies have shown that many users do not use effective data deletion techniques upon sale or surrender of storage devices. A logical assumption is that many users are still confused concerning proper sanitization techniques of devices upon surrender. This paper strives to measure this assumption through a buyback study with a survey component. We recorded participants' thoughts and beliefs concerning deletion, as well as general demographic information, in relation to actual deletion effectiveness on USB thumb drives. Thumb drives were chosen for this study due to their relative low cost, ease of use, and ubiquity. In addition, we also bought used thumb drives from eBay and Amazon Marketplace to use as a comparison to the wider world. We found that there is no statistically significant difference between buyback and market drives in terms of deletion methods nor presence of sensitive data, and thus our study may be predictive of the perceptions of the market sellers. In our combined data sets, we found over 60% of the drives tested still had recoverable sensitive data, and in the buyback group, we found no correlation between users' perceived versus actual effectiveness of deletion methods. Our results suggest the security community may need to take a different approach to increase the usability, availability, and/or necessity of strong deletion methods.