USB flash drives, also known as thumb drives or pen drives, are small data storage devices that use flash memory and have an integrated USB interface (Source). They are portable, removable, rewritable storage devices that allow users to save and transport files between devices (Source). USB flash drives offer an easy way to back up, store, share and access files across computers, networks and operating systems with a plug-and-play interface.
One common operation when using a USB flash drive is deleting files that are no longer needed. When a file is deleted from a USB drive, it is removed from the file system directory structure and appears to be erased. However, the actual data still remains on the storage device until it is overwritten by new data. This allows deleted files to be recovered using file recovery software as long as the original data has not been overwritten.
File Systems
USB flash drives typically use file systems like FAT32, exFAT, NTFS, HFS+, and EXT to organize and store data on the drive [1]. FAT32 and exFAT are the most common ones found on USB drives.
The file system manages how data is stored, organized, and retrieved on a drive. It uses structures like file allocation tables, inodes, and directories to keep track of files and folders. The file system also defines properties like maximum file sizes, volume sizes, and file name conventions.
FAT32 is compatible with almost all devices and operating systems, but it limits individual files to 4GB and volumes to 2TB. exFAT removes those limits, supporting larger files and volumes over 2TB, while maintaining good compatibility.
NTFS is commonly used by Windows, providing better performance and additional features like permissions and encryption. But it has limited compatibility with other devices. HFS+ is designed for macOS and EXT is commonly used on Linux.
Choosing the right file system requires balancing compatibility with the features and constraints needed for your USB drive.
Delete Process
When you delete a file from a USB flash drive, the file entry in the file system table is removed, but the actual data remains on the drive. The space occupied by the deleted file is marked as available to be overwritten by new data. However, until that space is overwritten, the original deleted file data is still physically present on the drive.
When you delete a file, the operating system simply removes the entry for that file from the file table that tracks files on the disk. But the actual data contents – the 1s and 0s that make up the file – are still intact in the same physical location on the disk. The space is now considered available and could potentially be overwritten in the future, but nothing has immediately wiped or erased the data.
This is why many “delete” operations on standard consumer storage devices like USB flash drives and hard drives don’t permanently destroy files immediately. The data remains intact until replaced by new data. So it’s often possible to recover deleted files using data recovery software as long as the original file contents have not yet been overwritten.
File Recovery
When a file is deleted from a USB flash drive, the file itself is not actually erased from the drive. Instead, the file system marks the space occupied by the file as available for new data. The original file remains on the drive until it is overwritten by new data.
Because the deleted file is still present on the drive, it is often possible to recover it using data recovery software. Programs like Disk Drill and Recoverit can scan the USB drive and rebuild files that have been marked for deletion. As long as the original file has not been overwritten, the entire file can often be restored.
Data recovery software works by looking for file signatures that indicate the start and end of files of different types. Once a deleted file is located, the recovery program will attempt to reconstruct the file’s directory entry so that it is no longer marked for deletion. The recovered file can then be saved to another location.
The effectiveness of data recovery depends on how much new data has been written to the USB drive since the file was deleted. The sooner data recovery is attempted, the greater the chances of successfully restoring a deleted file from a USB flash drive.
Permanent Deletion
To permanently delete files from a USB drive so that they cannot be recovered, you need to use secure deletion software or completely format the drive. Here are some methods for permanent file deletion:
Using Windows 10, you can use the built-in formatting tool toquickly and securely format your USB drive. Go to File Explorer, right-click on the USB drive, select “Format” and then check the box for “Quick Format”. This will permanently delete all files by overwriting the storage space on the drive.[1]
On Macs, you can use the Disk Utility app to erase and format the USB drive. Select the drive, click “Erase”, choose a format like “MS-DOS (FAT)” and click “Erase” to wiped the drive. This will render all previous files unrecoverable.[2]
Third-party secure deletion tools like Eraser or DBAN can be used to completely overwrite old data with junk patterns, meeting Department of Defense erasure standards. This prevents forensic recovery of deleted files.
Encrypting the USB drive with BitLocker or VeraCrypt prior to deleting files provides an extra layer of protection, as the encryption key would need to be cracked first before recovering any deleted data.
So in summary, the most thorough options are to fully format and overwrite a USB drive using build-in OS tools or third party software. This renders previously deleted files unrecoverable through standard means.
Data Overwrite
When a file is deleted from a USB flash drive, the reference to the file’s data is removed from the file system, but the actual data still remains on the drive. This allows deleted files to be recovered using data recovery software.
However, the data will eventually be overwritten as the USB drive reuses storage space. USB flash drives use flash memory, which can only be written to a finite number of times. To optimize performance and lifespan, the USB drive will reuse storage cells once they are marked as deleted.
According to Microsoft, once a file is overwritten on a USB drive, it becomes very difficult to recover. The longer you wait to attempt recovery, the more likely critical data will be overwritten.
Some tools like shred can deliberately overwrite deleted files to prevent recovery. But in general, USB drives will naturally reuse storage space over time as new data is added.
Encryption
Encryption can provide an important security benefit for USB flash drives. Services like Apricorn (https://apricorn.com/flash-keys/) and Kingston (https://www.kingston.com/en/usb-flash-drives/encrypted) offer encrypted USB drives that use AES hardware-based encryption to secure the data. This means even if the drive is lost or stolen, the data cannot be accessed without the password. Encryption protects deleted files from being recovered because the raw data is scrambled and unreadable without the encryption key.
When a file is deleted from an encrypted USB drive, the encryption protects the raw data. The filesystem may mark the file space as available for reuse, but the underlying encrypted data remains scrambled and inaccessible. This prevents common file recovery techniques from restoring deleted files on encrypted drives. The encryption key is required to decrypt and access the data, providing an extra layer of security for deleted files.
Overall, encryption makes deleted files far more secure on USB flash drives. The encryption renders the raw data unusable, preventing recovery of deleted files. For maximum security, users should utilize encrypted USB drives to protect sensitive data.
File Shredding
File shredding is a method of permanently deleting files by overwriting the data on the storage device multiple times. This process aims to make the original data unrecoverable by even advanced data recovery methods. Traditional file deletion through your computer’s operating system or file manager only removes the file reference and directory entry, but leaves the actual data intact on the storage device. File shredding goes beyond this by repeatedly overwriting the raw data until it becomes infeasible to recover the original contents (Source: https://www.lifewire.com/free-file-shredder-software-programs-2619149).
There are different standards for how many overwrite passes are required for secure data deletion. For example, the US Department of Defense recommends 7 passes, while other standards suggest 35 passes. File shredding programs will implement these standards to provide strong assurance against data recovery. Overall, file shredding provides much more complete deletion than traditional file operations like moving a file to the recycle bin (Source: https://www.fileshredder.org/).
Best Practices
When deleting sensitive files from a USB drive, it is important to take steps to prevent file recovery and ensure the files are securely erased. Here are some best practices:
Use encryption – Encrypt your USB drive to add an extra layer of security. This will scramble your files into unreadable gibberish that cannot be recovered without the password.
Perform a full format – Simply deleting files or reformatting the drive may not be enough, as data remnants can remain on the disk. Do a full format to overwrite all disk space and make file recovery extremely difficult.
Use file shredding software – Specialized file shredding tools like Eraser for Windows or Permanent Eraser for Mac can completely scrub target files, leaving no trace.
Do multiple overwrite passes – For maximum safety, use a tool that overwrites all data with random bit patterns multiple times. This leaves almost no chance of recovering the original data.
Destroy the USB drive – If the files contain highly sensitive information, physically destroying the USB drive by smashing or shredding it is the only way to be absolutely certain the data is unrecoverable.
Regularly wipe drives – Don’t just delete files. Periodically use a disk wiping tool to overwrite free space and protect against recovery of previously deleted files.
The risks of failing to properly delete sensitive files from a USB drive are significant. Deleted files can often be recovered using recovery software, allowing access to personal or confidential data. It is critical to use secure deletion methods to avoid identity theft, privacy violations, intellectual property theft, or other damaging data breaches.
Conclusion
When a file is deleted from a USB flash drive, the reference to the file’s data on the drive is removed from the file table, but the actual data still remains on the drive. The space occupied by the deleted file is marked as available to be overwritten by new data. Until that space is overwritten, recovery software can often restore deleted files by scanning the drive and reconstructing file tables.
There are risks associated with deleted file recovery. Other files may overwrite the deleted data, making recovery impossible over time. Some recovery software can be expensive. Attempting recovery yourself risks further data loss if not done properly. Encrypted drives present additional challenges.
For sensitive data, it’s best to use file shredding programs or encrypt drives, to prevent recovery. Regularly backing up important files provides an alternative to recovery. When disposing of USB drives, physically destroying them removes all risks of data being recovered.
In summary, deleted files may remain recoverable from USB drives until their storage space is reused. Caution should be exercised in how drives are handled and disposed of when they contain private or sensitive data.