File survival on USB drive

Author/Creator

Author/Creator ORCID

Date

2017

Type of Work

Department

Mathematics and Computer Science

Program

Citation of Original Publication

Rights

Abstract

Flash (or USB) drives are small, inexpensive, portable, store an immense amount of data and can connect to multiple types of devices, including computers, digital cameras, printers, scanners, and external hard drives. In addition, these devices are one of the most used forms of personal data transfer and storage. Smaller versions of the same technology are used in nearly all mobile devices, such as cell phones, digital cameras, and tablet computers. If a flash drive is lost or stolen, and not encrypted, any information on the drive is open to the public, including confidential information. Many people are not aware that when you delete a file from a flash drive, or any conventional computer hard drive, it is not permanently gone. In fact, the file is not removed at all, the device simply allows another device to write over the deleted file if a new file is being written to the device. In our study, we explored how long a deleted file from a flash drive will remain readable or partially readable, as we added and removed other files from the device. Using freeware tools, such as Forensic Toolkit (FTK) and Autospy, we can view all the contents of a flash device, including deleted and partially overwritten media. Using a target test file, we wrote the file to the flash device, deleted it, then randomly wrote and deleted files of various sizes to the drive to test how long the target file will remain unaltered or partially readable. We will discuss the results of this study and we hope to raise awareness of possible data recovery on flash devices and that the misuse of such devices can cause a personal security issue.