Is Your Data Gone? Comparing Perceived Effectiveness of Thumb Drive Deletion Methods to Actual Effectiveness

Previous studies have shown that many users do not use effective data deletion techniques upon sale or surrender of storage devices. A logical assumption is that many users are still confused concerning proper sanitization techniques of devices upon surrender. This paper strives to measure this assumption through a buyback study with a survey component. We recorded participants’ thoughts and beliefs concerning deletion, as well as general demographic information, in relation to actual deletion effectiveness on USB thumb drives. Thumb drives were chosen for this study due to their relative low cost, ease of use, and ubiquity. In addition, we also bought used thumb drives from eBay and Amazon Marketplace to use as a comparison to the wider world. We found that there is no statistically significant difference between buyback and market drives in terms of deletion methods nor presence of sensitive data, and thus our study may be predictive of the perceptions of the market sellers. In our combined data sets, we found over 60% of the drives tested still had recoverable sensitive data, and in the buyback group, we found no correlation between users’ perceived versus actual effectiveness of deletion methods. Our results suggest the security community may need to take a different approach to increase the usability, availability, and/or necessity of strong deletion methods.