It depends on the sensitivity of the data, if it is relatively low risk data
and you don't compete with the company in question, I would suggest simply
calling the credit card companies and telling them that the cc #s in
question are compromised and ask if they could send you new cards; this is
often free and even if not free will be less than the $100 loss; if the data
is too sensitive for this, I would contact the USB pen drive company and let
them know the issue, they might be willing to waive the need to send the
drive back in or might have some back way to wipe the drive (make sure to
speak to a supervisor). Any other methodology of deleting the data will
cause physical harm to the drive and will probably void the warentee that
you would be relying on to replace the drive in the first place.
John
-----Original Message-----
From: Scott Gossard [mailto:Scott.Gossard@wal-mart.com]
Sent: Thursday, September 30, 2004 8:17 AM
To: forensics@securityfocus.com
Subject: RE: Securely wiping a "dead" usb pen drive
I would take the $100 loss and use a sledgehammer on it. It's not worth
losing company data.
-----Original Message-----
From: jpippin [mailto:jpippin@nc.rr.com]
Sent: Tuesday, September 28, 2004 8:21 PM
To: forensics@securityfocus.com
Subject: Securely wiping a "dead" usb pen drive
Anyone have any idea how to wipe a solid state, lipstick sized usb drive
before returning it to the manufacturer for a replacement? The drive
stopped
responding while performing a complete file encryption of the data using
the
manufacturer's software. I have no reason to believe that everything was
actually encrpyted before we hit a nonresponsive state. The drive still
shows up when plugged into any usb port, but browsing gives an error and
a
notice that the drive must be formatted to continue - which doesn't
work,
either.
This usb drive holds company data and two credit card numbers, and
although
we can no longer access the information, it is still seen by the OSes,
which
forces me to infer a potential security risk if the manufacturer can
still
read the data. It's not worth the $100 loss for a new one if I can't be
reasonable sure it's unreadable. That said, is there a decent option to
wipe
such an inaccessable device? Magnets won't work on eeprom chips that I'm
aware, and microwave seems kinda questionable, so I'm open for
suggestions.
Thanks.
Joel
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
-----------------------------------------
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the individual or entity to whom they are addressed.
If you have received this email in error destroy it immediately.
**********************************************************************
Wal-Mart Stores, Inc. Confidential
**********************************************************************
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
