In Search of Lost Data: A Study of Flash Sanitization Practices

2025-05-20

AI Summary

This study addresses the widespread failure of thorough data sanitization in “brand-new” USB flash drives sold at low prices in the Chinese market. We conducted the first large-scale empirical digital forensic investigation, systematically examining 614 manufacturer-labeled USB drives using digital forensic analysis, physical-layer NAND flash data recovery, batch automated detection, and metadata correlation analysis. Results revealed that 12.2% of devices retained recoverable non-trivial user data—including 75 instances containing sensitive or illicit files—with no statistically significant external predictors of data remanence. This work is the first to empirically demonstrate systemic sanitization failure in chip-reuse scenarios, directly challenging the default assumption of consumer-grade storage devices being “trusted out-of-the-box.” Our findings provide critical empirical evidence for data security governance, supply-chain risk assessment, and the development of judicial digital forensic standards.

Technology Category

• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty
• Search and Optimization: Distributed Search

Application Category

• Security and Privacy: Data transparency and provenance
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity
• Responsible Web: Ethical and legal aspects of web-scale data analysis, uses and collection practices

Abstract

To avoid the disclosure of personal or corporate data, sanitization of storage devices is an important issue when such devices are to be reused. While poor sanitization practices have been reported for second-hand hard disk drives, it has been reported that data has been found on original storage devices based on flash technology. Based on insights into the second-hand chip market in China, we report on the results of the first large-scale study on the effects of chip reuse for USB flash drives. We provide clear evidence of poor sanitization practices in a non-negligible fraction of USB flash drives from the low-cost Chinese market that were sold as original. More specifically, we forensically analyzed 614 USB flash drives and were able to recover non-trivial user data on a total of 75 devices (more than 12 %). This non-negligible probability that any data (including incriminating files) already existed on the drive when it was bought has critical implications to forensic investigations. The absence of external factors which correlate with finding data on new USB flash drives complicates the matter further.

Problem

• Investigates poor sanitization practices in reused flash storage devices
• Analyzes data recovery risks from second-hand USB flash drives
• Highlights forensic implications of pre-existing data on new drives

Innovation

• Forensic analysis of USB flash drives
• Large-scale study on chip reuse effects
• Evidence of poor flash sanitization practices