[Jiggly]

Student, James Conacher decided to make a rather interesting projects for his Masters. James and the researchers purchased 100 USB drives from Ebay, and used publicly available tools to extract "deleted" data from them.
They found all kinds of data, such as passwords, contracts, bank statements and tax returns.

A BBC article discusses some of the findings from the study.

Code:

Cybersecurity researchers discovered about 75,000 files after buying 100 of the drives on an internet auction site. Some USB drives contained files named "passwords" and images with embedded location data. All but two of the drives appeared empty, but the team said it had been "worryingly easy" to retrieve data. The researchers used "publicly-available tools" to retrieve the sensitive information. They said only 32 of the drives had been properly wiped. Partial files were extracted from 26 devices and every single file was extracted from the remaining 42 USB drives. Many of the files extracted were determined to be of "high sensitivity."

The abstract of the study provided the following conclusion:

Code:

Using forensic analysis, it was found that a great deal of private and sensitive information remained on many of the drives, but there was no trace of malicious software. More effective ways of enlightening the public are needed, so that private data is not unwittingly leaked via sold used media.

[mothered]

This clearly demonstrates to either securely wipe your USB stick, or don't bother selling and smash It to bits.

Personally, I prefer the latter.

[Drako]

This is actually genius. If a criminal wanted even a small amount of information, he/she could abuse this method. And it's extremely easy to execute. On eBay you can easily compile a little over 800 listings of used USB drives of all sorts. With everything relevant staying under $30. Then, combining this with publically available data recovery tools like Recuva or PhotoRec, you can recover loads of sensitive information like this study concludes.

This is also a lesson in data privacy. You should always make sure any data on your USBs, HDDs, and SSDs, is overwritten before giving them away, throwing them away, or selling them. This is even easier to accomplish. There are other open source options, but programs like Darik's Boot and Nuke, and Remo Data Wipe are good options. The two programs I listed use a wiping algorithm called DoD 5220.22-M. Essentially all this algorithm does is overwite any data on the drive with a random 1, or a random 0. This is the most efficient way to erase data while also keeping safety in mind. There are other algorithms like Gutmann, but they take much longer, favoring safety over efficiency.

[Oni]

Always a good idea to do multiple passes when wiping drives. DoD 5220.22-M data sanitization is best.

[Jiggly]

This is actually genius. If a criminal wanted even a small amount of information, he/she could abuse this method. And it's extremely easy to execute. On eBay you can easily compile a little over 800 listings of used USB drives of all sorts. With everything relevant staying under $30. Then, combining this with publically available data recovery tools like Recuva or PhotoRec, you can recover loads of sensitive information like this study concludes.

This is also a lesson in data privacy. You should always make sure any data on your USBs, HDDs, and SSDs, is overwritten before giving them away, throwing them away, or selling them. This is even easier to accomplish. There are other open source options, but programs like Darik's Boot and Nuke, and Remo Data Wipe are good options. The two programs I listed use a wiping algorithm called DoD 5220.22-M. Essentially all this algorithm does is overwite any data on the drive with a random 1, or a random 0. This is the most efficient way to erase data while also keeping safety in mind. There are other algorithms like Gutmann, but they take much longer, favoring safety over efficiency.

Thanks for the detailed advice! Should I ever come to do any of this, I'll keep this in mind.

Honestly though, I've never let go of a single USB stick I own (except to let a family member borrow it). I've also never put information of that nature on a USB stick. Sure, I've stored essays and projects for university, but never passwords. I can understand why people store contracts on them, as it may be useful in their work.