Get a Pentest and security assessment of your IT network.

Cyber Security

USB Flash Drives: Firmware-Free Options?

TL;DR

Finding a USB flash drive *completely* without firmware is very difficult. Most rely on it for basic operation and wear levelling. However, some older or specialised drives come closer than others. We’ll look at what to consider and where to search.

Understanding the Problem

USB flash drives aren’t just simple memory chips. They need a controller chip to manage data storage, handle USB communication, and importantly, implement wear levelling (spreading writes across the memory to extend its life). This management is done by firmware – small programs embedded in the controller.

A drive without firmware would be very limited. It’d likely only work as a basic block storage device with no features like password protection, bad block handling or USB protocol quirks fixed.

Steps to Find (or Approximate) Firmware-Free Drives

  1. Understand What You Mean by ‘Firmware-Free’:
    • Truly No Firmware: Extremely rare. These are usually very old or specialised industrial drives.
    • Minimal Firmware: More realistic. Drives with the absolute minimum firmware needed for basic operation, and ideally open source firmware available.
    • Firmware You Can Replace/Remove (with caution): Some drives allow you to flash custom firmware, potentially replacing complex code with something simpler. This is risky!
  2. Research Older Drives:
  3. Older USB 1.0 and early USB 2.0 drives are more likely to have simpler controllers with less complex firmware. Look for models from the late 90s/early 2000s.

    • Key Manufacturers: M-Systems (now SanDisk), TrekStor, Kingston DataTraveler original series.
    • eBay & Second-Hand Markets: These are your best bet for finding older models. Search specifically for these brands and early USB drive types.
  4. Identify the Controller Chip:
  5. Once you have a potential candidate, you need to find out what controller chip it uses. This is crucial.

    • USB Device Info Tools: Use tools like usb-id (Linux) or USBDeview (Windows).
    • sudo usb-id -a
    • Teardown (Carefully!): If software identification fails, carefully open the drive casing and look for markings on the controller chip itself. Be very careful not to damage the drive.
  6. Search for Controller Chip Documentation:
  7. Once you know the controller chip model number (e.g., Alcor AU6973, SMI 2258), search online for datasheets and documentation.

    • Datasheet Availability: Datasheets may be hard to find, especially for older chips.
    • Firmware Information: Look for any mention of firmware requirements or the possibility of custom firmware flashing.
  8. Consider Open Source Firmware Projects (Advanced):
  9. Some projects aim to provide open-source firmware replacements for certain USB controllers.

    • Examples: Look at projects like USBBoot, though compatibility is limited and requires significant technical expertise.
    • Flashing Risks: Flashing incorrect firmware can brick your drive – render it unusable! Proceed with extreme caution.
  10. Test Thoroughly:
  11. If you find a drive that seems promising, test it extensively.

    • Basic Read/Write Tests: Verify data integrity.
    • Long-Term Reliability: Monitor for errors or failures over time.

Drives to Investigate (as of Oct 2023 – availability varies)

  • M-Systems DiskOnKey Original Series: Often used simpler controllers.
  • TrekStor DataStick: Early models may have minimal firmware.
  • Older Kingston DataTraveler Models (pre-2008): Some early versions are worth investigating.

Important Warnings

  • Data Loss Risk: Opening and modifying USB drives can result in data loss. Back up any important data before attempting anything.
  • Bricking Risk: Incorrect firmware flashing can render your drive unusable.
  • Complexity: Finding truly firmware-free or easily modifiable drives is challenging and requires technical skills.
Related posts
Cyber Security

Zip Codes & PII: Are They Personal Data?

Cyber Security

Zero-Day Vulnerabilities: User Defence Guide

Cyber Security

Zero Knowledge Voting with Trusted Server

Cyber Security

ZeroNet: 51% Attack Risks & Mitigation