Poor Sanitization Practices and Questionable Digital Evidence: A Comprehensive Study of Scope and Impact of Recycled NAND Flash Chips

IEEE Transactions on Dependable and Secure Computing, vol. 22, pp. 5970–5984

Abstract

In digital forensics, the provenance of data being used as digital evidence in court is frequently challenged. This is often done to raise doubts about whether the possession of some piece of illegal data was intentional. However, there may also be situations where the provenance of data is legitimately questioned, such as in the case of second-hand devices that were not well sanitized. This may also lead to the disclosure of personal or corporate data. While poor sanitization practices have already been observed for second-hand hard disk drives, this has not yet been reported for new storage devices based on flash technology. Based on insights into the second-hand chip market in certain countries, we report on the results of the first large-scale study on the effects of chip reuse for USB flash drives. We provide clear evidence of poor sanitization practices for USB flash drives from the low-cost market that were sold as new. More specifically, we forensically analyzed 1211 low-cost USB flash drives and were able to recover non-trivial data on a total of 76 devices (6%). Furthermore, we forensically analyzed 435 high-cost USB flash drives on which we could not find any evidence of chip recycling in this market sector.

Authors 12

1. Aya Fukami

   Netherlands Forensic Institute

   Affiliation as printed

   Netherlands Forensic Institute, The Hague, The Netherlands

2. Immanuel Lautner

   Friedrich-Alexander-Universität Erlangen-Nürnberg

   Affiliation as printed

   Department of Computer Science, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Erlangen, Germany

3. Maximilian Eichhorn

   Friedrich-Alexander-Universität Erlangen-Nürnberg

   Affiliation as printed

   Department of Computer Science, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Erlangen, Germany

4. Denise Moussa

   Friedrich-Alexander-Universität Erlangen-Nürnberg

   Affiliation as printed

   Department of Computer Science, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Erlangen, Germany

5. Julian Wolf

   Friedrich-Alexander-Universität Erlangen-Nürnberg

   Affiliation as printed

   Department of Computer Science, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Erlangen, Germany

6. Nicole Scheler

   Friedrich-Alexander-Universität Erlangen-Nürnberg

   Affiliation as printed

   Department of Law, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Erlangen, Germany

   Department of Computer Science, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Erlangen, Germany

7. Dominic Deuber

   Friedrich-Alexander-Universität Erlangen-Nürnberg

   Affiliation as printed

   Department of Law, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Erlangen, Germany

   Department of Computer Science, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Erlangen, Germany

8. Felix Freiling

   Friedrich-Alexander-Universität Erlangen-Nürnberg

   Affiliation as printed

   Department of Computer Science, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Erlangen, Germany

9. Jaap G. Haasnoot Aachen

   University of Applied Sciences Leiden

   Affiliation as printed

   Leiden University of Applied Sciences, Leiden, The Netherlands

10. Hans Henseler Aachen

    University of Applied Sciences Leiden

    Affiliation as printed

    Leiden University of Applied Sciences, Leiden, The Netherlands

11. Simon Malik

    Albstadt-Sigmaringen University

    Affiliation as printed

    Albstadt-Sigmaringen University, Albstadt, Germany

12. Holger Morgenstern

    Albstadt-Sigmaringen University

    Affiliation as printed

    Albstadt-Sigmaringen University, Albstadt, Germany