Personal data put at risk by auction of unclaimed USB drives

[danrok]

RailCorp sold lost drives with owner's personal data still recoverable, see front page:
http://www.aoaforums.com/frontpage/c...sb-drives.html

Comments?

[Aedan]

The only problem with the story that I can see was that the USB drives were already lost. The fact is that there was easily accessible personal data on them before RailCorp picked them up. Perhaps the original owners of the USB drives should have used crypto?

[Daniel ~]

"Not economically feasible"

The good we've turned away from with those words...

[Aedan]

It's actually surprisingly difficult to destroy all the information on a flash drive. You see, the controller has to pull all sorts of tricks to make flash actually usable as a drive, and it's those tricks that make it hard.

"Not economically feasible" in this case just means that it'd cost more to ensure the USB drives were erased than they'd get back selling them.

[Daniel ~]

Doesn't seem like one method would be just as labor intensive as another?

[Aedan]

The fun with flash drives is that there's more flash memory on board than the capacity of the drive. Flash is a little touchy about erases, so the controller will move blocks around so that the flash is "worn" evenly. Think of it as a bit like rotating the tyres on your car, including the spare.

Hence, if you overwrite every sector of the flash drive, it's still got the spare, and there's still data in it.

[Daniel ~]

And the spare (Swap?) portion of the drive is more inaccessible?

[Gizmo]

The 'extra' portions of the drive are 'shadow' storage.

Think of it this way: You have a restaurant that can serve 2 customers at a time. You can never let your customers sit with an empty plate, or without a plate at all for more than a second, because that's the level of service you guarantee. You can't bring the kitchen to both tables (impractical from a resource-usage standpoint), so your only choice is to prepare the food in the kitchen and bring it to the table, but you can't do that in the one second that you have to provde the service within.

Your best option is to have extra plates. Howe many extra plates is a function of how many customers you plan to serve at one time, and how long it takes to prepare and deliver the food to the customers.

How do you guarantee that ALL of the plates are clean, given that you ALWAYS have to have 2 of the plates in front of the customers?

[Daniel ~]

Make them lick their plates!
or
hire a very fast dishwasher

I like the first option... it has a symmetry about it....