In Search of Lost Data: A Study of Flash Sanitization Practices

TL;DR

This study investigates the prevalence of poor sanitization practices on second-hand USB flash drives from China, revealing that over 12% still contain recoverable user data, which has significant forensic implications.

Contribution

It provides the first large-scale forensic analysis of reused flash chips in USB drives, highlighting widespread sanitization issues in the Chinese low-cost market.

Findings

Over 12% of analyzed drives contained recoverable user data

No external factors correlated with data presence on new drives

Implications for forensic investigations and data security

Abstract

To avoid the disclosure of personal or corporate data, sanitization of storage devices is an important issue when such devices are to be reused. While poor sanitization practices have been reported for second-hand hard disk drives, it has been reported that data has been found on original storage devices based on flash technology. Based on insights into the second-hand chip market in China, we report on the results of the first large-scale study on the effects of chip reuse for USB flash drives. We provide clear evidence of poor sanitization practices in a non-negligible fraction of USB flash drives from the low-cost Chinese market that were sold as original. More specifically, we forensically analyzed 614 USB flash drives and were able to recover non-trivial user data on a total of 75 devices (more than 12 %). This non-negligible probability that any data (including incriminating files) already existed on the drive when it was bought has critical implications to forensic investigations. The absence of external factors which correlate with finding data on new USB flash drives complicates the matter further.