New Thumb Drive Encryption Procedure

By Michael Altfield, on February 4th, 2018

In this article, I’ll describe a procedure for preparing a brand-new USB flash drive for use. First we’ll securely erase all the data on the drive, then we’ll encrypt the entire drive, and–finally–we’ll check the drive for bad blocks.

Ah, remember the good-ole days of spinning disks? When your OS could tell your hard *disk* to shred a specific sector? Like it or not, those days are gone in the land of USB flash volumes.

There’s a lot of great reads on the complications of securely erasing data on a USB thumb drive. Unfortunately, a lot of the techniques are not universal to all technologies or manufacturers. Consequently, my approach is more ignorant, straight-forward, and broad (at the risk of causing these cheap usb drives to fail sooner & the process taking longer):

First, I make sure never to write any unencrytped data to the disk
Second, when I want to wipe the disk, I fill it entirely with random data

Below are the commands that I use to prepare a new usb drive for my use immediately after purchase. These commands are presented as a rough guide; they’re mostly idempotent, but you probably want to copy & paste them one-command-at-a-time until you’ve followed this procedure a few times & know what to expect.

# first, mount the drive & assign this var to the device we're dealing with
sudo su -
shredDevice="/dev/sde"

# make temporary mount dir
tmpDir="`/bin/mktemp -d -p '/mnt'`"
shredMount="${tmpDir}"

# unique name without slashes in it (for log files, etc)
uniqueName="`echo \"${shredMount:1:(-1)}\" | tr '/' '-'`"

# attempt to mount (if this fails, you'll have to proceed manually--perhaps with per-partition mount & shredding)
umount "${shredDevice}"
umount "${shredMount}"
umount "/dev/mapper/${uniqueName}"
mount "${shredDevice}" "${shredMount}" 

# verify before proceeding that this isn't blank
echo "${shredDevice}"
echo "${tmpDir}"
echo "${shredMount}"

# verify contents match what's expected in thunar
ls -lah "${shredMount}"

# delete all existing files
srm -v -f -l -r "${shredMount}/"

# do it a second pass, because it sometimes errors-out at the end & needs a double-tap to finish properly (yes, yes--but this works)
srm -v -f -l -r "${shredMount}/"

# make sure it's all been applied
sync "${shredMount}/"

# create new, temp fs on device directly (no partitions)
umount "${shredMount}"
mkfs.ext4 -j -F -v "${shredDevice}"

# mount it & fill it up
mount "${shredDevice}" "${shredMount}"
sfill -v -f -l "${shredMount}/"

# make sure it's all been applied
sync "${shredMount}/"

# verify it's empty
ls -lah "${shredMount}"

# umount
umount "${shredMount}"

# create encrypted luks volume on the entire device
cryptsetup luksFormat "${shredDevice}"

# decrypt the new encrypted volue
cryptsetup luksOpen "${shredDevice}" "${uniqueName}"

# create a new FS on the entire drive + check for bad blocks
mkfs.ext4 -j -F -v -c -c "/dev/mapper/${uniqueName}"
e2fsck -v "/dev/mapper/${uniqueName}"

# umount
cryptsetup luksClose "/dev/mapper/${uniqueName}"

# cleanup
rm -rf "${tmpDir}"

And below are the commands I use when I want to securely erase the (already encrypted) data on a drive that’s already been setup following the guide above:

# first, mount the drive & assign this var to the device we're dealing with
sudo su -
shredDevice="/dev/sde"

# make temporary mount dir
tmpDir="`/bin/mktemp -d -p '/mnt'`"
shredMount="${tmpDir}"

# unique name without slashes in it (for log files, etc)
uniqueName="`echo \"${shredMount:1:(-1)}\" | tr '/' '-'`"

# verify before proceeding that this isn't blank
echo "${shredDevice}"
echo "${tmpDir}"
echo "${shredMount}"

# attempt to mount (if this fails, you'll have to proceed manually--perhaps with per-partition mount & shredding)
cryptsetup luksOpen "${shredDevice}" "${uniqueName}"

umount "${shredDevice}"
umount "${shredMount}"
umount "/dev/mapper/${uniqueName}"
mount "/dev/mapper/${uniqueName}" "${shredMount}"

# check contents
ls -lah "${shredMount}"

# delete what's already there
srm -v -f -l -r "${shredMount}/"
sync "${shredMount}/"

# do it a second pass, because it sometimes errors-out at the end & needs a double-tap to finish properly (yes, yes--but this works)
srm -v -f -l -r "${shredMount}/"
sync "${shredMount}/"

# then secure-ish wipe
sfill -v -f -l "${shredMount}/"
sync "${shredMount}/"

# use badblocks through the e2fsck command using read-write
umount "/dev/mapper/${uniqueName}"
e2fsck -v -c -c "/dev/mapper/${uniqueName}"
sync "${shredDevice}/"

# exit cleanly
cryptsetup luksClose "/dev/mapper/${uniqueName}"
rm -rf "${tmpDir}"