Source-linked AI summary
In Search of Lost Data: A Study of Flash Sanitization Practices
Janine Schneider, Immanuel Lautner, Denise Moussa, Julian Wolf, Nicole Scheler, Felix Freiling, Jaap Haasnoot, Hans Henseler, Simon Malik, Holger Morgenstern, Martin Westman
TL;DR
Prior findings of data on new flash storage raised concern that drives sold as new might contain data from former use, complicating forensic attribution. The paper examines low-cost USB drives and reports recovered user data on 12% of the devices, with no clear correlating factors beyond supplier-batch clustering.
Problem
The paper asks whether new USB drives contain data from prior component use and what factors influence the presence of non-trivial user data.
Source: §1 · p. 1, §1.1 · p. 2Method
The study treats non-trivial user data as an indicator of chip recycling and examines low-cost USB drives for data and possible correlates.
Source: §4.3 · p. 5, §5.5 · p. 7Results
12% of the analyzed low-cost new USB drives contained data, and findings clustered within supplier batches rather than across batches.
Source: §7 · p. 10Takeaways & Limitations
Files recovered from new USB drives may not originate from their current owners, limiting their probative value in criminal proceedings.
Source: §6 · p. 10The study found no clearly correlating factors beyond supplier-batch clustering, and visual characteristics could not be evaluated for 130 of 614 drives.
Source: §5.5 · p. 8, §7 · p. 10
Abstract
from arXiv · showhide
To avoid the disclosure of personal or corporate data, sanitization of storage devices is an important issue when such devices are to be reused. While poor sanitization practices have been reported for second-hand hard disk drives, it has been reported that data has been found on original storage devices based on flash technology. Based on insights into the second-hand chip market in China, we report on the results of the first large-scale study on the effects of chip reuse for USB flash drives. We provide clear evidence of poor sanitization practices in a non-negligible fraction of USB flash drives from the low-cost Chinese market that were sold as original. More specifically, we forensically analyzed 614 USB flash drives and were able to recover non-trivial user data on a total of 75 devices (more than 12 %). This non-negligible probability that any data (including incriminating files) already existed on the drive when it was bought has critical implications to forensic investigations. The absence of external factors which correlate with finding data on new USB flash drives complicates the matter further.
1. Introduction
Prior findings of recoverable data on used devices raised questions about whether new USB drives could also contain data from earlier use. This study examines the risk in cheap promotional drives and whether observable factors predict such data.
1. Introduction
- Earlier reports of recoverable data on used storage and findings on new USB drives raised concern that new drives may contain data from prior use.Such data complicates attribution when incriminating files are found on a drive claimed to have been bought new.Source: §1 · p. 1
1.1. Research Questions
- The study asks how often new drives contain data from former component use and which factors influence that probability.The authors use non-trivial user data as the measurable indicator of chip recycling and focus on low-cost promotional drives.Source: §1.1 · pp. 1–2
1.2. Contributions
- 75 of 614 drives contained non-trivial user data, providing evidence of poor sanitization among low-cost Chinese-market drives sold as original.The study also reports no other clear predicting indicator of chip reuse through external or internal factors.Source: §1.2 · p. 2
- The paper discusses methodological and legal consequences of its findings for forensic investigations.The authors describe the study as the first large-scale examination of chip reuse effects in cheap and promotional USB drives.Source: §1.2 · p. 2
1.3. Paper Outline
- The paper proceeds from technology and market background to study design and results, then discusses legal implications and concludes.The outline places the legal discussion after the results.Source: §1.3 · p. 2
2. Background
The background describes NAND flash and the managed eMMC and component-level ONFi technologies used in USB storage. It contrasts removal operations whose timing or completeness can depend on the controller with secure operations that specify more complete removal behavior.
2. Background
- USB thumb drives mainly use memory chips with built-in controllers, most following eMMC and some ONFi.The paper reviews these technologies with a focus on data-sanitization possibilities.Source: §2 · p. 2
2.1. Flash Storage
- NAND flash stores information through charge states in floating-gate transistors, with controlled charge states allowing multiple bits per cell.The described cell types range from SLC at 1 bit per cell to TLC at 3 bits per cell.Source: §2.1 · p. 2
2.2. eMMC Technology
- eMMC combines flash media and a device controller in one managed package and specifies host commands, addressing, and erase groups.An erase group is removed through range-start, range-end, and erase commands.Source: §2.2 · pp. 2–3
2.2.1. Simple Data Removal Operations
- Erase and TRIM may defer physical removal to a convenient controller time, while Discard can return some or all original data.On successful Erase or TRIM, the targeted range behaves as overwritten and moves to the unmapped host address range.Source: §2.2.1 · p. 3
2.2.2. Secure Data Removal
- Secure Erase and Secure TRIM perform secure purges, with Secure TRIM separating block marking from the subsequent removal step.A block written between the two Secure TRIM steps is not marked and remains untouched by that erase operation; later standard versions favor Erase/TRIM followed by Sanitize.Source: §2.2.2 · p. 3
2.3. ONFi Technology
- ONFi standardizes NAND-component interfaces and form factors but excludes the device controller, so erase routines cannot be generally specified for ONFi devices.The LUN can perform physical block erases, but controller-dependent routines may differ by manufacturer.Source: §2.3 · p. 3
3. The USB Flash Drive Market
The market discussion connects promotional USB drives to a supply chain in which low-cost components and informal chip recycling create incentives to reuse memory. It describes how reused chips may enter drives sold as new.
3.1. Market Players
- Promotional USB drives pass through manufacturers, suppliers, distributors, finishers, and advertising agencies, with many manufacturers based in Shenzhen and sourcing eMMC chips from Taiwan or South Korea.Customers in Europe typically approach an agency, distributor, or supplier.Source: §3.1 · p. 4
- Low prices can make class B drives more likely, and these may contain chips with reduced capacity due to malfunction or production problems.Explicitly ordering class B drives is unusual, but selecting the cheapest drives can result in receiving them.Source: §3.1 · p. 4
3.2. The Chinese Chip Recycling Market
- Informal recycling favors reuse of components, and low costs and weak regulation create incentives to declare old chips as new.Reused chips may enter a new drive either through reuse of a whole drive or through recovery and resale of a chip from another appliance; mixing old and new chips is described as a possible way to conceal provenance.Source: §3.2 · p. 4
4. Study Design
The study was designed to estimate the probability of finding non-trivial user data on new USB drives and assess whether measurable drive factors might relate to that outcome. It combines low-cost drive acquisition with forensic imaging and analysis.
4.1. Possible Influencing Factors
- Candidate predictors included manufacturer, location, company size, and company name.Source: §4.1 · p. 4
- The study also recorded NAND type, chip capacity and maker, eMMC standard, and visible chip features such as reuse stamps.Source: §4.1 · p. 4
4.2. USB drive acquisition
- Because many factors were hard to control, acquisition prioritized cost and capacity, targeting cheap drives from Alibaba vendors.Source: §4.2 · pp. 4–5
- FAU bought 500 drives from 10 randomly selected vendors, while Leiden acquired three 4 GB batches and MSAB supplied a small 16 GB batch.Source: §4.2 · p. 5
- Albstadt’s 600 acquired drives were excluded because analysis remained incomplete, avoiding possible selection bias.Source: §4.2 · p. 5
4.3. Measurements
- Non-trivial user data meant identifiable user content recovered by a common file carver and confirmed not to be a false positive by visual inspection.Source: §4.3 · p. 5
- Analysts created forensic images using repeatable written procedures, and senior researchers checked results before entry into the central dataset.Source: §4.3 · p. 5
- Some drives lacked enough visible chip cues to identify NAND technology, eMMC standard, or chip manufacturer.Source: §4.3 · p. 5
5. Results
Across 614 analyzed drives, 75 contained non-trivial user data, and the findings indicate that chips—not whole USB drives—were recycled. The results also show varied prior-use data and supplier associations, but no clear correlation with useful external factors.
5.1. General Information
- 75 of 614 analyzed drives contained non-trivial user data; excluding two likely pre-shipment test-picture cases, researchers assumed recycled chips in at least 73 of 650 drives.Any partially or fully reconstructable and readable user data counted; random data, false positives, and corrupted data were excluded.Source: §5.1 · p. 6, Table 1 · p. 6
5.2. Types of Data Found
- Recovered files ranged across media, images, maps, archives, and icons; Korean, Taiwanese, Indian, Chinese, and Japanese-origin material was also observed.Source: §5.2 · pp. 6–7
- Analysis identified prior Android, Chrome OS, Linux, smart-TV, printer, and voice-recorder use; 16 drives contained Android-related data, including private images and videos.On one drive, 10,298 GIFs and JPGs were reconstructed; metadata could not be analyzed in the three cases involving private pictures, videos, or movies.Source: §5.2 · p. 6
5.3. USB Drive and Chip Characteristics
- Data findings were highly correlated with particular suppliers, especially S3, S11, and S12.Source: §5.3 · p. 7
5.4. Visual Inspection
- Inspection found regular serial or manufacturer inscriptions and logos, alongside irregular stamps, paint, handwritten notes, dirt, and scratches.Irregular stamps appeared on 28 chips; paint on 10, notes on 6, and dirt on 8. Some visually marked drives also contained data.Source: §5.4 · p. 7
5.5. Correlation
- No clear correlations linked data findings to NAND technology, chip architecture, or reuse signs; Samsung-data correlation was 0.716, including maps at 0.777.The reported coefficients also include 0.459 for Samsung and Smart TV data, 0.742 for Kingston and Android, and 0.641 for SanDisk and Chrome OS.Source: §5.5 · p. 8
- Overall, no useful external factors correlated clearly with data findings, while supplier batches showed a relationship; 130 drives lacked visual inspection, and higher-end brands remain untested.The authors suggest that finding data on one drive in a supplier batch makes data on other batch drives more likely; investigating higher-end brands is future work.Source: §5.5 · p. 8
6. Legal Implications
Recovered data on a USB drive bought as new may not have come from its owner, limiting its value as evidence. The authors warn that investigators and courts should critically examine such evidence because forensic analysis may not establish when files were saved or deleted.
6. Legal Implications
- The authors illustrate the stakes with a scenario in which recovered files and accidental findings lead to further investigative measures and potential harm to a person’s reputation and rights.The scenario concerns a businessman facing tax-evasion proceedings.Source: §6 · pp. 8–9
- Forensic examination may recover deleted files, but the file system’s overwritten structure can prevent determining when files were saved or deleted.The paper describes this as worsening the difficulty of assessing whether the current owner knew of the files.Source: §6 · p. 9
- Files found on a USB drive bought as new may not originate with its current owner, so their probative value in criminal proceedings can be severely limited.The paper says investigators and courts should critically examine forensic results rather than rely on chains of circumstantial evidence whose individual pieces have limited value.Source: §6 · p. 10
7. Conclusions and Future Work
The study found data on 12% of cheap, new USB drives and no clear correlating factors beyond clustering within supplier batches. Its conclusions are limited to the low-cost market, with higher-priced drives left for future study.
7. Conclusions and Future Work
- 12% of cheap, new USB drives contained data, indicating weak sanitization practices in this market sector.The authors say these practices violate good data-protection methods and may be classified as fraud in some jurisdictions.Source: §7 · p. 10
- No clear correlating factors emerged for user data, although findings clustered within supplier batches rather than across them.The authors connect this pattern to increased uncertainty about the provenance of data without metadata found by file carving.Source: §7 · p. 10
- The study focused on the cheapest promotional, no-name, and pirated no-name drives, so it could not test drive price as a correlating factor.The authors say they confirmed Westman’s conjecture that chip recycling was relevant in this market and could serve as an excuse for suspects who recently deleted incriminating evidence.Source: §7 · p. 10
- A follow-up study of higher-priced, more quality-oriented brands using eMMC remains future work.The authors note that such a study would require a substantially higher research budget.Source: §7 · p. 10
CRediT authorship contribution statement
The contribution statement assigns work across conceptualization, data curation, investigation, methodology, analysis, supervision, and writing. Roles vary across the listed contributors.
CRediT authorship contribution statement
- Janine Schneider is credited with conceptualization, formal analysis, methodology, software, supervision, visualization, validation, data curation, investigation, and writing.Her writing roles include the original draft and review and editing.Source: CRediT authorship contribution statement · p. 10
- Immanuel Lautner, Denise Moussa, Jaap Haasnoot, and Simon Malik are credited with data curation or investigation, with validation and writing also attributed to Lautner and Moussa.Lautner and Moussa contributed to the original draft; Haasnoot and Malik are listed for data curation and investigation.Source: CRediT authorship contribution statement · p. 10
- Felix Freiling, Hans Henseler, Holger Morgenstern, and Martin Westman are credited with conceptualization, while Freiling also contributed methodology, supervision, and writing.Julian Wolf and Nicole Scheler are credited with writing; Wolf also contributed investigation, and Scheler contributed review and editing.Source: CRediT authorship contribution statement · p. 10