How to Securely Wipe a USB Drive or External Hard Drive

Introduction

USB flash drives and external hard drives and SD cards travel everywhere. They get lent to coworkers, forgotten in hotel rooms, lost in bags and donated with old electronics. Every one of these devices contains recoverable data from every file ever stored on it, even files you deleted months or years ago.

Portable storage is uniquely risky because it leaves your physical control far more often than an internal drive. You cannot protect a USB drive with a login password the way you protect a laptop. Once someone has the physical device, they have access to everything on it. The only protection is ensuring that the data on the device has been properly destroyed before it leaves your hands.

Why Formatting Does Not Erase Your Data

Quick Format: Windows quick format takes seconds because it does almost nothing to the data. It creates a new file allocation table (FAT32 or exFAT or NTFS) and marks the entire device as empty. The actual data remains completely intact in every sector. Recovery tools restore files from a quick-formatted drive in minutes with near-100% success rates.

Full Format: A full format in Windows 10/11 performs a single-pass zero overwrite of all sectors followed by a file system rebuild. This is significantly better than a quick format and blocks casual recovery with free tools. However, a single-pass zero is the weakest possible overwrite pattern and does not meet recognized erasure standards like DoD 5220.22-M or NIST 800-88.

macOS Erase: Disk Utility’s Erase function on macOS performs a quick format equivalent by default. The “Security Options” slider (available only for HDD-based external drives) lets you choose 1-pass to 3-pass overwriting. This option is not available for USB flash drives or external SSDs on modern macOS versions.

Four Types of Portable Storage and How They Differ

The key difference between these devices is TRIM support. Internal SSDs use TRIM to clear deleted data in the background. Most USB flash drives and SD cards do not support TRIM, which means deleted data persists indefinitely until manually overwritten. External SSDs connected via USB may support TRIM if both the drive and the USB enclosure support UASP (USB Attached SCSI Protocol), but this is not guaranteed.

Because most portable storage lacks TRIM, deleted files on USB drives and SD cards are highly recoverable for as long as the device exists. This makes deliberate overwriting the only reliable way to destroy data on portable media.

Method 1: Secure Wipe with Univik File Eraser

Step 1: Connect the USB drive or external drive to your computer. Wait for Windows to recognize it and assign a drive letter.

Step 2: Open Univik File Eraser and select Wipe Entire Drive. Choose the connected portable device from the drive list. Double-check the drive letter to avoid accidentally wiping the wrong drive.

Step 3: Select your erasure standard. For USB flash drives and SD cards, single-pass Random Data is sufficient because flash memory does not retain residual signals. For external HDDs, DoD 5220.22-M (3-pass) provides additional assurance. For external SSDs, single-pass Random Data with post-wipe verification is recommended per NIST guidelines.

Step 4: Click Start. The software overwrites every sector on the device. Progress tracking shows completion percentage and estimated time. A 32 GB USB flash drive completes in under 5 minutes with a single pass. A 1 TB external HDD takes approximately 2.5 hours for a 3-pass DoD wipe.

Step 5: After completion, the device contains only the overwrite pattern. You can format it with your preferred file system for reuse or dispose of it knowing that no data is recoverable.

Method 2: Full Format in Windows (Limited Security)

If you cannot install software, a Windows full format provides basic protection against casual recovery.

Step 1: Open File Explorer, right-click the portable drive and select Format.

Step 2: Uncheck “Quick Format” to enable the full format option. Select your preferred file system (exFAT recommended for cross-platform compatibility).

Step 3: Click Start. The full format writes zeros to every sector before rebuilding the file system. This takes significantly longer than quick format (approximately 30 minutes per 32 GB on USB 3.0).

Limitations: Single-pass zero only (weakest overwrite pattern). No post-wipe verification. No erasure certificate. No configurable standards. Does not meet DoD or NIST requirements. Adequate for giving a USB drive to a friend but not for compliance scenarios or high-sensitivity data.

Method 3: Diskpart Clean All Command

Windows Diskpart provides a command-line method for overwriting an entire drive with zeros.

Step 1: Open Command Prompt as Administrator.

Step 2: Run the following commands in sequence:

Critical warning: Diskpart operates at the disk level with no confirmation prompt. If you select the wrong disk number, you will destroy your Windows installation. Verify the disk number carefully by checking the size column in the “list disk” output. Your portable drive’s size should be clearly different from your internal drive.

The clean all command writes zeros to every sector on the selected disk. It takes the same amount of time as a full format. After completion, the disk has no partition or file system. You must create a new partition and format it before the drive can be used again.

Limitations: Single-pass zero only. No progress indicator (the cursor blinks until completion). No verification. No erasure certificate. High risk of accidental data loss if the wrong disk is selected. No undo capability.

Which File System to Use After Wiping

For most portable storage, exFAT is the best choice. It works natively on Windows and macOS and Linux without drivers or limitations. It supports files larger than 4 GB (which FAT32 does not) and does not have the macOS read-only restriction that NTFS has. Format the wiped drive as exFAT after the secure wipe completes.

Special Considerations for SD Cards

SD cards present unique challenges for secure wiping. Many SD cards include a physical write-protect switch on the side of the card. Ensure this switch is in the unlocked position before attempting any wipe operation. If the card appears read-only in Windows, check the switch first.

Some SD cards use wear leveling similar to SSDs but without the TRIM command. This means deleted data persists indefinitely. A full-device overwrite is the only reliable erasure method. Unlike SSDs, SD cards do not support ATA Secure Erase or NVMe Format commands because they use the SD protocol rather than ATA or NVMe.

Camera-formatted SD cards often use FAT32 with a specific directory structure (DCIM folder). After securely wiping the card, format it in the camera rather than in Windows. Cameras create their own optimized directory structure and formatting in-camera ensures compatibility with the specific device.

When to Physically Destroy Instead of Wiping

Software wiping is not always the right choice. Consider physical destruction when:

The device has failed. If the USB drive or SD card is not recognized by any computer, software cannot write to it. A dead device may still contain readable NAND chips that a determined attacker could desolder and read with specialized equipment.

The device cost less than the time to wipe it. A 4 GB USB flash drive that costs $3 is not worth 10 minutes of wiping time. Snap it in half and recycle the pieces. The cost of replacement is less than the value of your time.

The data was classified or extremely sensitive. Government agencies and financial institutions often mandate physical destruction for media that held classified data. Software wiping satisfies most commercial requirements, but physical destruction provides absolute certainty.

How to physically destroy portable media: For USB flash drives, use pliers to snap the circuit board. For SD cards, cut them with scissors through the NAND chip. For external HDDs, open the enclosure and scratch the platters with a screwdriver. For external SSDs, open the enclosure and snap the circuit board containing the NAND chips.

Frequently Asked Questions

Can I wipe a USB drive that Windows says is write-protected?

Some USB drives have a physical write-protect switch. Check the device body for a small slider. If no switch exists, try clearing the write protection through Diskpart: open Command Prompt as Administrator, run diskpart, select the disk, then run attributes disk clear readonly. If this fails, the drive’s controller may have locked it due to hardware failure and software wiping is not possible.

How long does it take to securely wipe a USB drive?

Speed depends on the drive’s write speed and capacity. A 32 GB USB 3.0 flash drive (writing at ~50 MB/s) takes about 11 minutes for a single pass. A 1 TB external HDD (writing at ~120 MB/s) takes about 2.5 hours for a single pass or 7.5 hours for a 3-pass DoD wipe. External SSDs are fastest, often completing a 1 TB single-pass wipe in under 30 minutes.

Does “Eject” securely erase data from a USB drive?

No. The Eject function flushes any pending writes to the drive and safely disconnects it from the system. It does not delete or overwrite any data. Ejecting is about preventing file corruption during removal, not about data security.

Should I wipe a brand-new USB drive before using it?

Not for security reasons because a new drive should not contain previous data. However, some users wipe new drives to verify they are functioning correctly (a drive that fails a full-device write test may have defective sectors). For sensitive environments, wiping before first use satisfies the chain-of-custody requirement that only known-clean media enters the organization.

Conclusion

Last verified: February 2026. Secure wiping tested on SanDisk Ultra USB 3.0 (64 GB), Samsung T7 Portable SSD (1 TB), Seagate Expansion Portable HDD (2 TB) and SanDisk Extreme microSD (256 GB with USB adapter). Post-wipe recovery scans performed with Recuva 1.53 and PhotoRec 7.2. Format behavior tested on Windows 11 24H2. macOS Disk Utility Security Options verified on macOS Sequoia 15.3.

Portable storage devices are the most likely to leave your control and the least likely to have their data properly destroyed before they do. A quick format does nothing. A full format does the minimum. Only a deliberate overwrite with Univik File Eraser guarantees that every file you ever stored on the device is permanently unrecoverable. Connect the drive, select Wipe Entire Drive, choose your standard and let it run. Five minutes for a USB stick or a few hours for a large external HDD is a small price for ensuring your data never ends up in the wrong hands.