Notes on USB drive formatting

Mike's Notes

Taking Pipi security seriously. A collection of notes copied from here and there about formatting USB drives. The sources are listed in the resources.

In the meantime, measures include air-gapping and turning off all wifi.

Later, we will employ data diodes and many other measures.

Resources

• https://techcommunity.microsoft.com/discussions/windows11/how-to-completely-wipe-usb-drive-on-windows-11-or-windows-10-pc/4279200
• https://www.manageengine.com/device-control/badusb.html
• https://github.com/1Developpeur/Anti-BadUSB
• https://github.com/topics/badusb?l=shell
• https://forums.malwarebytes.com/topic/105881-does-formatting-a-usb-disk-make-it-secure-for-future-use/
• https://github.com/greatscottgadgets/facedancer
• https://www.adafruit.com/product/6005
• https://github.com/Starfield-Reverse-Engineering/Ghidra-Tutorial
• https://security.stackexchange.com/questions

References

• Reference

Repository

• Home > Ajabbi Research > Library >
• Home > Handbook > 

Last Updated

04/09/2026

Notes on USB drive formatting

By: Mike Peters & Google

On a Sandy Beach: 01/01/2026

Mike is the inventor and architect of Pipi and the founder of Ajabbi.

Time required to format a USB drive

The time it takes to fully format a USB drive depends entirely on the drive's total storage size and the speed of the USB port, not the volume of files currently stored on it. A 64GB USB drive will take the exact same amount of time to fully format whether it is completely empty or completely full. Because a full format writes zeros to every gigabyte of storage, speed is limited by the USB drive's write performance.

• 16 GB Drive: Takes roughly 2 to 5 minutes.
• 32 GB Drive: Takes roughly 5 to 10 minutes.
• 64 GB Drive: Takes roughly 10 to 20 minutes.
• 128 GB Drive: Takes roughly 20 to 45 minutes.
• 256 GB+ Drive: Can take over an hour.

Two factors determine where the drive falls on that time estimate:

• USB Generation: A USB 3.0 or 3.2 drive plugged into a matching blue or Type-C port will format significantly faster than an older USB 2.0 drive, which is capped at very slow data transfer speeds.
• Hardware Quality: Cheap, promotional USB drives use low-grade flash memory with incredibly slow write speeds, meaning they can take two to three times longer to format than high-quality name-brand drives.

What is a BadUSB Attack and How to Prevent It?

BadUSB, as the name suggests, is a crafty cybersecurity attack that acts as a puppeteer, controlling your USB devices at will. A BadUSB attack occurs when a USB device has a built-in firmware vulnerability that lets it disguise itself as a human interface device. Once connected to its target computer, a BadUSB could then discreetly execute harmful commands or inject malicious payloads.

A common type of BadUSB attack involves a MalDuino device. It uses a programmable USB device that mimics a keyboard when plugged into a system. This device can be pre-configured to automatically inject numerous malicious keystrokes into an unsuspecting user’s computer, enabling attackers to execute commands and compromise the system within seconds.

Within organisations, a preventative measure such as USB blocking software is a necessity because BadUSB attacks, if undetected or unstopped, could result in the unauthorised execution of commands that instigate security bypass incidents, privilege escalation, DDoS attacks, or malware infections of the host computers, which could then spread to target entire networks.

A BadUSB attack is incredibly dangerous because the malware does not live in the storage partition where your files are kept; it lives inside the USB controller chip's firmware.

When you perform a standard Windows format (even a full format), the computer only interacts with the flash memory storage blocks. It completely ignores the controller chip that dictates how the USB device talks to the computer.

How a BadUSB Attack Works.

• The Disguise: The compromised firmware tricks your computer into thinking the USB drive is not a storage device at all, but rather a USB keyboard or network card.
• The Execution: The moment you plug it in, the chip sends rapid, invisible keystrokes to your computer.
• The Result: It can open your command prompt, download malware from the internet, and compromise your system in under three seconds—all before you even have a chance to open File Explorer or click "Format."

What are the types of BadUSB?

The different types of BadUSB found commercially available are:

• MalDuino
• WiFi-enabled BadUsb
• BadUsb Cables

MalDuino

MalDuino is an open-source Arduino-based BadUSB that injects malicious payloads into a target computer. Gaining widespread attention recently, MalDuino packs several more features than regular BadUSB devices thanks to its onboard computer.

MalDuino devices commonly found today support Micro SD cards and include a set of DIP switches that let users toggle between stored programs on the card.

WiFi-enabled BadUsb

This type of BadUSB is similar to MalDuino in that an Arduino board serves as the base for the device but is specially designed with WiFi capabilities. Once plugged into a target system, these devices allow attackers to introduce malicious payloads into a victim's computer using the WiFi protocol.

WiFi-enabled BadUSB can take different forms depending on the exact purpose and function they serve. The common iterations of this device used today are as follows.

• WiFi-enabled keystroke injectors
• WiFi keyloggers
• WiFi deauthers

WiFi-enabled keystroke injectors

These are the most common types of WiFi BadUSB found today. When plugged into a target computer, these devices remain dormant until an attacker makes further contact through a smartphone or a neighbouring system. Connecting to this BadUSB is as simple as connecting to a WiFi access point.

Once connected, the attacker can inject keystrokes using a suitable scripting language. These devices often come with their own applications that allow hackers to execute scripts remotely.

WiFi keyloggers

WiFi keyloggers are modern hacker hardware that particularly targets desktop computers. They work as a bridge between the keyboard's USB terminal and the computer itself. This BadUSB intercepts input signals from the keyboard and relays them to the hacker's computer.

WiFi keyloggers capture everything the user types, including sensitive information and passwords, without raising suspicion. On desktop computers, these devices can be completely hidden from plain sight and do not affect keyboard performance while in use.

WiFi deauthers

WiFi Deauthers are malicious devices that leverage flaws present in the WiFi protocol to force all users of a WiFi network to disconnect automatically. Subsequently, WiFi Deauthers prevent users from reconnecting as long as the device is active.

WiFi deauthers differ from other forms of BadUSB in that they do not directly affect the systems they connect to; instead, they use them as a power source to disrupt network connectivity and cause downtime.

BadUSB Cables

Gaining widespread attention recently, BadUSB cables look and function like any other USB cable, but they are secretly malicious devices that inject scripts and malware into a computer without the user's knowledge.

Also known as USB Ninja and USB Harpoon, these generic-looking cables hide a BadUSB within their internal circuitry and are more deceptive than many other variants. A BadUSB cable can support functions such as charging and data transfer while malicious activity happens in the background.

How to Deal with a Suspected BadUSB

If you believe a USB drive has compromised firmware, formatting it from Windows will not make it safe. You have three real options:

1. Physical Destruction (Safest): Throwing the drive in the trash or physically destroying it is the only 100% reliable fix for everyday users. Flash drives are cheap; your data security is not.
2. Firmware Flashing: You would need to find the exact manufacturer's tools for that specific controller chip and overwrite the firmware. This is highly technical, risky, and often impossible for generic drives.
3. Hardware Write-Blockers: IT security professionals use specialised hardware to inspect suspicious drives without allowing data to flow back to the PC.

BadUSB Removal

No software-based open-source security tools can safely "remove" or clean BadUSB malware from a standard flash drive. Because the malicious code is hardcoded directly into the hardware's internal controller chip, a computer's operating system cannot reach, overwrite, or clean it through traditional software tools.

However, the open-source community has developed powerful tools to detect and block these attacks, as well as complex technical frameworks used by hardware reverse engineers to overwrite the controller chip entirely.

Open-Source Tools to Detect & Block Attacks

Rather than fixing the drive, these open-source tools sit on your computer and intercept a BadUSB device the second it tries to emulate a keyboard or inject malicious keystrokes:

• Anti-BadUSB (Python-based): A popular open-source Python script hosted on GitHub. It continuously monitors keyboard inputs across your operating system. If a newly inserted USB device begins typing commands at superhuman speeds (keystroke injection), it instantly flags and blocks the input before the script can execute.
• USB Auth Guard: A lightweight, open-source Linux security tool. It locks down your system's USB ports by default. When a new device is plugged in, it forces a security authentication prompt (via polkit) before the operating system can interact with the device. This completely stops human interface device (HID) exploits.
• Linux Kernel udev Monitoring: Built-in open-source Linux subsystems can be configured to catch BadUSB activity. By opening a terminal and running udevadm monitor, you can see the exact moment a device is plugged in. If a USB storage stick suddenly triggers a kernel event trying to install a "HID Keyboard," you will catch the disguise instantly.