Reverse-Engineered Wipe Residue Scanner

[shreyas-omkar]

Proposal: Reverse-Engineered Wipe Residue Scanner

Overview

This proposal introduces a post-wipe residue scanner for SecureWipe.
The scanner is a minimal, reverse-engineered forensic component whose sole purpose is to detect the presence of residual data after a wipe, not to recover or reconstruct user files.

The scanner treats storage devices, particularly USB flash media, as imperfect and potentially deceptive systems, where “successful wipe” signals may not reflect actual physical erasure.

---

Goals

• Validate wipe effectiveness using empirical evidence
• Detect residual data structures at the block level
• Avoid file recovery or user data exposure
• Remain fast, probabilistic, and auditable
• Complement existing wipe and attestation mechanisms

Non-goals:

• Full forensic reconstruction
• Filesystem recovery
• Legal-grade evidence tooling

---

Motivation

Flash-based storage devices frequently employ wear leveling, caching, and lazy erase strategies. As a result, overwrite-based wipes may leave behind persistent data even when software reports success.

Most secure wipe tools assume cooperative firmware behavior. This scanner challenges that assumption by actively probing for known persistence failure modes observed in flash controllers.

---

High-Level Design

The residue scanner operates in four phases:

1. Sampling Phase

• Randomly sample logical block addresses (LBAs)
• Bias sampling toward historically problematic regions:
  • Early and late LBAs
  • Controller remap-prone regions
• Sampling remains bounded to avoid full-device scans

2. Entropy Analysis

• Measure entropy of sampled blocks
• Compare against expected entropy for the selected wipe method
• Flag blocks with statistically improbable values

3. Signature Heuristics

• Detect partial or full remnants of:
  • Filesystem superblocks
  • Partition table markers
  • Repeating block motifs
• No attempt is made to reconstruct or interpret files

4. Temporal Persistence Check (Optional)

• Re-scan after device replug or power cycle
• Detect reappearance of stale blocks or patterns

---

Output

The scanner produces a structured report containing:

• Residue confidence score
• List of suspicious block ranges
• Summary verdict:
  • No detectable residue
  • Possible residue detected
  • High-confidence persistence detected

No user data is extracted, displayed, or reconstructed.

---

Safety and Ethics

• Scanner operates strictly at block-level metadata and statistics
• No file carving or content reconstruction
• Designed for verification, not surveillance or data recovery
• Results are probabilistic and must be clearly documented as such

---

Risks and Limitations

• Cannot detect data hidden entirely behind controller abstraction
• False positives possible on noisy or failing devices
• Not a cryptographic proof of erasure

These limitations must be explicitly communicated to users.

---

Proposed Timeline

Phase 1: Research and Modeling

• Catalog common flash persistence failure modes
• Define entropy and signature thresholds
• Identify minimum viable heuristics

Phase 2: MVP Implementation

• Block sampler
• Entropy analyzer
• Basic signature detection

Phase 3: Integration

• Optional post-wipe execution
• CLI/UI reporting
• Machine-readable output format

Phase 4: Validation

• Test across multiple USB flash devices
• Power-cycle persistence tests
• Threshold tuning and false-positive analysis

---

Discussion Questions

• Should the scanner run automatically after every wipe?
• Should high-confidence residue detection invalidate wipe success?
• How do we expose probabilistic results without misleading users?
• Should residue scanning be disabled by default?

---

Summary

The reverse-engineered wipe residue scanner enhances SecureWipe by introducing a verification layer that challenges assumptions about storage firmware behavior. It provides measurable confidence in wipe operations while remaining focused, ethical, and technically grounded.