  Previous studies have shown that many users do not use effective data
deletion techniques upon sale or surrender of storage devices. A logical
assumption is that many users are still confused concerning proper sanitization
techniques of devices upon surrender. This paper strives to measure this
assumption through a buyback study with a survey component. We recorded
participants' thoughts and beliefs concerning deletion, as well as general
demographic information, in relation to actual deletion effectiveness on USB
thumb drives. Thumb drives were chosen for this study due to their relative low
cost, ease of use, and ubiquity. In addition, we also bought used thumb drives
from eBay and Amazon Marketplace to use as a comparison to the wider world.
  We found that there is no statistically significant difference between
buyback and market drives in terms of deletion methods nor presence of
sensitive data, and thus our study may be predictive of the perceptions of the
market sellers. In our combined data sets, we found over 60% of the drives
tested still had recoverable sensitive data, and in the buyback group, we found
no correlation between users' perceived versus actual effectiveness of deletion
methods. Our results suggest the security community may need to take a
different approach to increase the usability, availability, and/or necessity of
strong deletion methods.
