Solved Best utility to securely wipe specific files from flash drives?

When sharing flash drives with others, I want to make sure I'm securely erasing old files—not just removing them from the directory, but completely wiping their actual contents.

What utility software would you recommend for this?

Ideally, I need a tool that:

• Securely deletes every single block of the targeted files.
• Does not erase any more than necessary, in order to conserve the flash media's write cycles.

I think you're obsessing way to much about the FLASH media life. Just do a wipe with any of the many utilities, problem solved. I can't imagine you'll use up the drive write cycles before you die of old age! I think almost any currently shipping FLASH drive should do at least 10,000 write cycles. Also, any FLASH drive you're giving away or sharing is doubtless not a super high capacity 1TB drive, so the possibility of a $20 drive failing is not exactly a financial catastrophe.

No off-the-shelf security tool exists, because of how SSD's handle wear leveling. An OS writes to a set of logical blocks, but the SSD's onboard controller decides the mapping of logical blocks to physical blocks (or cells).

Normally to securely erase a file on a non-SSD device, you overwrite the file's assigned data blocks with junk data. This works because the mapping of logical to physical blocks never changes on a HDD (with the exception of remapped failed disk blocks).

When you write junk data to a file on a SSD, the onboard controller writes that data to a different set of physical blocks and updates the logical mapping so the OS thinks the file is securely wiped. But the original data is untouched on the drive. To get around this behavior, you would need special firmware in the SSD to make sure wear leveling isn't obeyed. There's no industry standard for that on consumer drives.

Some SSD's have tools where you can trigger a secure wipe of the entire drive, but not for individual files or volumes.

You can share data in encrypted ZIP files. This way using a data recovery tool doesn't help someone recover your deleted files, because they're encrypted in the first place.

As Garlin said, overwrite with junk data or, with low cost of flash drives being what it is, if you are that concerned purchase new drives before sharing. You make it sound like the data you are "sharing with others" is top secret information. First thing I thought of when I read this is smoke coming out of Mr. Phelps recorder and hearing "This drive will self destruct in 5 seconds."
Sounds like much ado about nothing to me.

glasskuter said:

As Garlin said, overwrite with junk data or, with low cost of flash drives being what it is, if you are that concerned purchase new drives before sharing.

Click to expand...

SSD's are different, you can't overwrite the SAME disk blocks with junk data. Because when you write any changes to a SSD, wear leveling returns a different physical block of data every time.

Most people understand flash memory cells have a limited number of writes before it fails. That number isn't guaranteed, but each flash memory manufacturer has a safe number of minimum writes before an expected failure.

Say that number is 50,000 times for a single cell. If you could write to the exact same cell in the SSD over that limit then a future write will eventually fail. You could get a "hot spot" where some block of data is overwritten more often than another block. That hot spot will fail first, but another part of the SSD where the data is rarely changed will have a longer lifetime because it's never disturbed.

As a strategy to improve cell lifetimes, the SSD itself will spread new writes to "random" blocks scattered across the drive in an effort to average out writes so the burden of writes is shared over a larger pool of eligible blocks. If you were writing 50,000 times to a single logical block, the SSD would round-robin those 50,000 writes across thousands of other physical cells. So each individual cell shares the burden of get written to, but each cell's average write history increments by a few.

HDD's are slower, but in general a disk block on magnetic media doesn't care if it's written to 5 times, 50 times, or 50,000 times. You can't "wear out" a magnetic drive in the same fashion as an SSD. SSD's are faster and more compact, but the tradeoff is we can't do secure file erases because of limitations in the flash memory technology.

A full format should write to every sector and indeed remove the data.

Even if you don't do this, since the data isn't available with any normal access method, it's not likely to be discovered by a casual user.

Here's a few choices of ways to totally erase all the data...

garlin said:

You can share data in encrypted ZIP files. This way using a data recovery tool doesn't help someone recover your deleted files, because they're encrypted in the first place.

Click to expand...

I think, that’s the approach I am going to take.

Baeolophus said:

I think, that’s the approach I am going to take.

Click to expand...

Good plan if it's anything you want to keep private. I regularly use encrypted ZIP files to send stuff, then I text the receiver and give them the PW.

gunrunnerjohn said:

Good plan if it's anything you want to keep private. I regularly use encrypted ZIP files to send stuff, then I text the receiver and give them the PW.

Click to expand...

What utility do you use to generate the encrypted ZIP files? What encryption algorithm is used? Is it AES-128 or AES-256?

Baeolophus said:

What utility do you use to generate the encrypted ZIP files? What encryption algorithm is used? Is it AES-128 or AES-256?

Click to expand...

I use 7-Zip and select AES-256 encryption.

gunrunnerjohn said:

I use 7-Zip and select AES-256 encryption

Click to expand...

I wish I could have a droplet that has the encryption pre-selected. That way, it will be much easier to use for people who might otherwise be overwhelmed by the 7-Zip options dialogue.

Just a thought..... You can always work with VeraCrypt containers. and use VeraCrypt as portable software, so you never need to install the program.
Then you get a drive within the drive so to speak.

Marie SWE said:

Just a thought..... You can always work with VeraCrypt containers. and use VeraCrypt as portable software, so you never need to install the program.
Then you get a drive within the drive so to speak.

Click to expand...

Not sure that's truly easier. I think the novice could get into trouble with VeraCrypt much easier than with 7-Zip.

gunrunnerjohn said:

Not sure that's truly easier. I think the novice could get into trouble with VeraCrypt much easier than with 7-Zip.

Click to expand...

Its kind of easy.......... or am i to poisoned by the long time nerdiness exposure.

Marie SWE said:

Its kind of easy.......... or am i to poisoned by the long time nerdiness.

Click to expand...

Maybe a bit. I find 7-Zip pretty easy to generate a passworded archive, and if I screw up, it's just the easily replaced archive that gets dented.

gunrunnerjohn said:

Maybe a bit. I find 7-Zip pretty easy to generate a passworded archive, and if I screw up, it's just the easily replaced archive that gets dented.

Click to expand...

maybe a bit........ i have nooooooooooooooo idea of what you talking about.

Just fill the drive to its full capacity with junk files. The controller has no choice but to overwrite all blocks if you fill the drive to capacity.
FYI: the default state of each memory cell is all logic 1s or, in hex, all Fs after a true wipe, not all 0s as some might expect.

Scott said:

Overwrite Deleted Data on Drive in Windows 11 and 10

This tutorial will show you how to overwrite (secure erase) deleted data on a drive so it can't be recovered or accessed in Windows 10 and Windows 11. When you delete files or folders, the data isn't initially removed from the hard disk. Instead, the space on the disk that was occupied by the...

www.elevenforum.com

Click to expand...

I don't think it works for SSD's. You're just creating new data without erasing the old blocks.

Here is how I handle this on my flash drives:

I create two partitions. One is BitLocker encrypted. That way I can carry all my personal data safely and I have a second unencrypted partition that I can use to share data with other people. If I hand the drive to someone else, they have zero visibility to my private data, but they have full access to the public partition. This also avoids all nonsense such as erasing data for security.