USB flash drives have been a staple of personal and business computing for over two decades. They are cheap, convenient, and easy to lose, which is precisely why they present a data security risk that is often underestimated. When it is time to dispose of old USB sticks, the data on them deserves serious attention even if the drives themselves are almost worthless as hardware.
The Data Security Risk
A USB flash drive can hold anywhere from a few gigabytes to several terabytes of data. Over its lifetime, a single drive may have carried thousands of files, from business presentations and financial spreadsheets to personal photos and password lists. Even drives that appear empty may contain recoverable data.
The small size of USB drives compounds the risk. They are easily lost, forgotten in drawers, or accidentally given away. A lost USB drive containing sensitive business data is a potential data breach under the Privacy Act 1988 and the Notifiable Data Breaches scheme.
How to Wipe a USB Flash Drive
Simply deleting files or formatting a USB drive does not destroy the data. Like hard drives, USB flash drives retain data after deletion until the storage cells are overwritten.
For personal drives, you can use disk wiping software that writes random data across the entire drive, then verifies the overwrite. Free tools are available for Windows, macOS, and Linux. A single overwrite pass is sufficient for flash media.
For business drives that have contained sensitive data, use a wiping tool that complies with NIST 800-88 Rev. 2 and generates a verification report. Alternatively, physical destruction is simple and effective for USB drives (more on this below).
Keep in mind that USB flash drives, like SSDs, use flash memory with wear levelling. This means some data might exist in inaccessible spare blocks that a standard overwrite cannot reach. For most practical purposes, a full overwrite renders data unrecoverable. For high-security data, physical destruction is the only way to be completely certain.
Physical Destruction Options
For USB drives that have stored genuinely sensitive data, physical destruction is straightforward and provides the highest level of certainty.
Professional shredding: An ITAD provider or data destruction service will feed USB drives through an industrial shredder, reducing them to small fragments. This is the recommended approach for business drives, as the service provider issues a certificate of destruction documenting each drive’s serial number and the destruction method.
DIY destruction: For personal drives, you can destroy the flash memory chip by cutting the drive in half with a pair of heavy-duty scissors or tin snips, snapping the drive and bending it repeatedly until the circuit board fractures, or using pliers to crush the memory chip. The goal is to physically damage the NAND flash chip to the point where it cannot be read.
Note that simply snapping the USB connector off the drive is not sufficient. The memory chip is still intact and can be soldered to a new connector or read directly. You need to damage the chip itself.
Recycling USB Drives
From a materials perspective, individual USB drives have minimal recycling value. They contain a small amount of copper on the circuit board, a flash memory chip (silicon), a USB connector (copper and steel), and a plastic or metal housing. The total recoverable material per drive is measured in grams.
However, when collected in volume, USB drives contribute to the broader e-waste recycling stream. The circuit boards are processed alongside other electronic circuit boards for precious metal recovery, and the housings are sorted by material type.
Where to recycle: Council e-waste drop-off points accept USB drives at transfer stations. Professional e-waste recyclers accept them alongside other equipment. Some office supply stores have small e-waste collection bins for items like USB drives, batteries, and cables.
Other Flash Storage Media
The same principles apply to other types of flash storage that you might find during a cleanout:
SD cards and microSD cards are even smaller than USB drives, making them easier to lose and overlook. They are commonly used in cameras, phones, tablets, and drones. Wipe them using the same approach as USB drives, or physically cut them in half for destruction.
CompactFlash and CFexpress cards are used in professional cameras and some industrial equipment. They contain more material than SD cards but follow the same recycling and data destruction principles.
Memory Stick (Sony proprietary format) and other legacy flash formats may still be found in old equipment. Treat them the same as other flash media for disposal purposes.
Business Policy Considerations
Organisations should have a clear policy on USB drive disposal as part of their broader IT asset management and data security framework. Key elements include maintaining a register of USB drives issued to staff (if drives are company-provided), requiring all USB drives to use hardware encryption, establishing a clear return and disposal process when drives are no longer needed, and prohibiting staff from disposing of company USB drives through personal channels.
Many organisations are moving away from USB drives entirely, replacing them with cloud storage and file sharing platforms that offer better security controls and audit trails. If your organisation still uses USB drives, consider whether cloud alternatives might reduce both the security risk and the eventual e-waste burden.
For comprehensive guidance on data destruction across all media types, see our guide to NIST 800-88.
EWV helps Victorian businesses manage e-waste and IT asset disposal compliantly and sustainably — including collection, certified data destruction, and recycling. Contact us for a free quote.