We’ve all been there. A colleague, friend, or relative hands you a USB flash drive followed by the famous words: "Don’t worry, I formatted it. It’s clean."
If you work in IT or cybersecurity, your internal alarms probably start ringing. For years, my personal policy was simply never to plug untrusted USB drives into my main systems. But sometimes, you just can’t avoid it. Many times, I found myself thinking: what is the most reliable, cheap, and fast way to sanitize a USB device before it ever touches my OS?
That train of thought led to the USB Neutralizer a tiny hardware device built on the incredibly cheap Raspberry Pi Pico and fast enough no matter of the size of the USB drive. In a matter of seconds you have a device which you can safely plug to your System.
⚠️ WARNING: DATA DESTRUCTION ⚠️ Plugging a USB drive into this device will instantly and permanently destroy its partition tables. All files and data will be lost. Do not connect a drive unless you intend to erase it.
Bill of Materials
1) Waveshare RP2040-Zero Pico-Like MCU Development Board (amazon.com, aliexpress)
2) 2-in-1 USB-C Splitter (amazon.com, aliexpress.com)
3) Keychain Case [optional] (thingiverse)
4) 3 x M2 x 4 mm self tapping screws [optional]
5) 3 mm length x 2 mm diameter transparent acrylic rod (if you plan to print the custom case) amazon.com
6) A USB-C power plug to power the device (it could be powered either from external source or from a computer/mobile device)
How it works
USB Neutralizer is a "portable device" oriented and functional with the two dominant partitioning schemes the legacy Master Boot Record (MBR) and the "modern" GUID Partition Table (GPT). Logical Volume Manager (LVM), Zettabyte File System (ZFS) zpools, Btrfs subvolumes, Intel Rapid Storage Technology(Intel RST) are out of scope.
Every storage device requires a "partitioning scheme" to know how the available storage space is divided up. A partition structure defines how information is structured on the partition (File System), where partitions begin and end, and also the code that is used during startup if a partition is bootable. This information is required by the operating system to know which sectors belongs to each partition and how to interact (boot, mount) with them.
USB Neutralizer is a bootloader/partition table killer designed to wipe just the minimum number of data blocks to render the USB Drive unusable by the operating system. Then without worrying for any malicious code, the USB can be safely plugged to your Operating System, reformatted and used for file storage.
In its current form it wipes the first 34 and last 34 Logical Block Addressing (LBA) sectors. This results in fully nulling:
- MBR: LBA 0 (512 bytes)
- Primary GPT Header: LBA 1 (512 bytes)
- Primary GPT Partition Array: LBA 2-33 (16384 bytes)
- Secondary GPT Partition Array & Header: Last 34 LBAs (17408 bytes)
Setup
- Navigate to github and get the latest build of the firmware.
- Make sure your Raspbery PICO board is completely disconnected from power and computer.
- Press and hold the white BOOTSEL button on the board.
- While still holding the button down, plug the USB cable into your computer, then release the button.
- The Pico will mount as a USB mass storage device named RPI-RP2.
- Copy and paste (or drag and drop) the usb-neutralizer.uf2 file directly into the root folder of the mounted RPI-RP2 drive.
- Congratulations, your USB Neutralizer is ready!
Usage
⚠️ WARNING: DATA DESTRUCTION ⚠️ Plugging a USB drive into this device will instantly and permanently destroy its partition tables. All files and data will be lost. Do not connect a drive unless you intend to erase it.
- Plug the 2-in-1 USB-C Splitter cable to your Raspberry PICO board.
- Plug a power cable to the USB-C port.
- A startup sequence with the LED briefly cycling through Red, Green, and Yellow confirms proper device functionality.
- While idle and waiting for a USB drive to be plugged in the LED will be Flashing Yellow.
- Plug a USB flash drive to the USB 2.0/3.0 port.
- The onboard led will be Flashing Orange indicating that a drive has been connected and the partition tables are actively being shredded. Avoid removing the device during the shredding phase.
- A Solid Green led is an indicatation of Sanitization complete. The drive is neutralized and safe to remove.
- A Solid Red led is an indication of an error during the wipe process. The device was not neutralized avoid using it without proper cybersecurity pratices.
Code
The full code is available on github as well as the compiled binary.
3d Files
Keychain style case consists of two 3d printed parts (top and bottom):
Both of them are available on thingiverse