Poor Sanitization Practices and Questionable Digital Evidence: a Comprehensive Study of Scope and Impact of Recycled NAND Flash Chips

Schneider J, Fukami A, Lautner I, Eichhorn M, Moussa D, Wolf J, Scheler N, Deuber D, Freiling F, Haasnoot J, Henseler H, Malik S, Morgenstern H, Westman M (2025)

Publication Language: English

Publication Type: Journal article, Original article

Publication year: 2025

Journal

IEEE Transactions on Dependable and Secure Computing Institute of Electrical and Electronics Engineers (IEEE)

DOI: 10.1109/TDSC.2025.3579237

Abstract

In digital forensics, the provenance of data being used as digital evidence in court is frequently challenged. This is often done to raise doubts about whether the possession of some piece of illegal data was intentional. However, there may also be situations where the provenance of data is legitimately questioned, such as in the case of second-hand devices that were not well sanitized. This may also lead to the disclosure of personal or corporate data. While poor sanitization practices have already been observed for second-hand hard disk drives, this has not yet been reported for new storage devices based on flash technology. Based on insights into the second-hand chip market in certain countries, we report on the results of the first large-scale study on the effects of chip reuse for USB flash drives. We provide clear evidence of poor sanitization practices for USB flash drives from the low-cost market that were sold as new. More specifically, we forensically analyzed 1211 low-cost USB flash drives and were able to recover non-trivial data on a total of 76 devices (6%). Furthermore, we forensically analyzed 435 high-cost USB flash drives on which we could not find any evidence of chip recycling in this market sector.

Authors with CRIS profile

Immanuel Lautner Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Maximilian Eichhorn Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Denise Moussa Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Julian Wolf Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Nicole Scheler Lehrstuhl für Strafrecht, Strafprozessrecht, Internationales Strafrecht und Völkerrecht Dominic Deuber Graduiertenkolleg 2475/2 - Cyberkriminalität und Forensische Informatik Felix Freiling Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)

Related research project(s)

GRK2475: Cyberkriminalität und Forensische Informatik (GRK 2475) Oct. 1, 2019 - Sept. 30, 2028

Involved external institutions

Netherlands Forensic Institute NL Netherlands (NL) CISPA − Helmholtz-Zentrum für Informationssicherheit DE Germany (DE) Micro Systemation AB (MSAB) SE Sweden (SE) Leiden University NL Netherlands (NL) Albstadt-Sigmaringen University DE Germany (DE)

How to cite

APA:

Schneider, J., Fukami, A., Lautner, I., Eichhorn, M., Moussa, D., Wolf, J.,... Westman, M. (2025). Poor Sanitization Practices and Questionable Digital Evidence: a Comprehensive Study of Scope and Impact of Recycled NAND Flash Chips. IEEE Transactions on Dependable and Secure Computing. https://doi.org/10.1109/TDSC.2025.3579237

MLA:

Schneider, Janine, et al. "Poor Sanitization Practices and Questionable Digital Evidence: a Comprehensive Study of Scope and Impact of Recycled NAND Flash Chips." IEEE Transactions on Dependable and Secure Computing (2025).

BibTeX: Download