[Dailydave] Forensics: USB fobs

[Alaric Dailey]

Dave Aitel wrote:
> Someone yesterday at a conference talk I went to told the crowd that
> you can overwrite a file (aka srm it) on a USB Key fob and it will
> still be there
> for Autopsy to see. That makes no sense to me. Can anyone verify this?
>
> -dave
>
Believe it or not, I have run across info recently that confirms this
AND that it can be harder to destroy data on flash memory than it is
magnetic media. And in a bit of related news:

http://www.usatoday.com/news/nation/2006-08-30-cell-phone-secrets_x.htm

Given this info, I find it annoying that "Window Washer" won't wipe
flash media.  If anyone looks at such a tool, be sure that you get one
that wipes the NTFS  journals (PGP calls this the NTFS Internal File
Structures), ideally such a tool would also support the Gutmann Wipe.