Reusing Smartphone Memory Chips in Brand New USB Drives

Where do your USB drives come from?

At an international computer forensics conference in March of this year, experts and law enforcement collaborators discussed a serious challenge investigators are facing when analyzing data from USB drives. Martin Westman, digital forensics and storage media expert, and Aya Fukami from the National Police Agency Japan, have found evidence that in some cases, old data from former computer users can be found on brand new USB drives.

In the fall of 2016, a Swedish computer user made an unbelievable discovery.  When inserting his daughter’s USB drive into his laptop, in addition to her wedding pictures, he also found a photo of a driver´s license belonging to a Chilean individual. This came as a big surprise to his daughter, as she never had any contact with this man and the USB drive was brand new. Alarmed by this news, Martin Westman researched the problem and discovered that this happens with standard eMMC memory chips more often than not.

According to the research, this presents a serious problem for computer forensic experts, as, proving to be difficult for them to understand if data found on a USB drive is from the past or current user.  This impacts any criminal or legal investigations surrounding a device. Because of this, more intensive analysis must be made in the future in order to prove that the data found is really from the previous computer user. Until now, the process was that if illegal content was found on the drive, an investigation would be opened and the device would be investigated as a piece of evidence.

Now, with the findings from both Martin Westman and Aya Fukami,there is much more work to be done. If it is unclear whether the data is from the current owner of the stick, the historical data must be examined. In order to complete this, the metadata of the files (documents and pictures) must be examined. Additionally, the serial numbers of the memory chips must be called out. With this number and the corresponding device ID number, the former owner of the smartphone memory chips in the USB can be identified.  Investigators will then need to check to see if the criminal content is from the current USB user or the previous owner of the memory chip. The process is time-consuming, but is critical for gathering appropriate evidence in an investigation.

Takeaways

What should a consumer do if they run into this problem? The best solution is to not purchase the cheapest USB drive available, but to purchase a product from a well-known brand and producer. Purchasing cheap USB drives from an unknown and untrustworthy source on the Internet, for example, might not be the best idea.

Additionally, these scenarios show the importance to every computer user to be extremely cautious with their data in old smartphones. Many people purchase old computer equipment or smartphones through an Internet source or in lesser-known computer shops.  It is essential to delete all your personal data from smartphones or any other external flash device before selling them or giving them away. Because flash drives are different from magnetic-based storage devices, they cannot be securely and fully deleted with common erasure software. Only special software, like Blancco Mobile Device Eraser, should be used.

Load more comments