USB Drives - what to store

I've been lurking for a while, and decided it's time for my first posting.
I've been reading about people adding USB thumbdrives to their kits, storing pertinent documents, scans of banking or identification documents, medical info, and the like. Any other Ideas? Home inventories?

Advantage: Store lots of data in a very small space and relatively rugged.

Disadvantages: Need a "newer" computer to access data (and perhaps a special driver as well). If lost/stolen, might make you an identity theft victim if data is not encrrypted. Identity theft will take you YEARS to straighten out.

Here's what I have on mine: Documents scanned in.
Info for myself & wife.
Social Security card
photo of self & wife
Birth Certificate
Will
Drivers License
Diplomas High School
Regents
AAS
Baptismal Certificate
Medical History
Medical insurance
Car & truck Registration
Title
Insurance Card
USMC DD 214
Marriage License
House Insurance Info
Pet Information:
Pictures of pets
Merlin License
Immunizations
Freydis Immunizations
Victoria Immunizations

The comment about identity theft is a good one. Hopefully, USB will be around for a while. I think that a USB port is standard on computers now.

Identity theft isnt that big of a scare. If anyone whom has any self motivation and your intelligent to be reading this forum to begin with....you can easily prevent someone from stealing your idenity ie. keep up with your sh*t, dont go nosing around on goofy websites, dont order stuff from any oddball
jo-schmo website, and simply if you dont want it "out there" dont put it up for display. etc.........and simply keep an eye out on your accounts. One other tip is to stay with VISA they are more secure than most. Encryption is a safe bet..........but keep in mind its not fool proof. I consider the USB ( i carry one myself for personal, work, business. etc..) like my wallet-dont lose it, and if you do, you better be ready to know the appropriate resources shut down your accounts, and stabalize all of your loose ends securily.
Also, if a computer is so old that it dosent have any usb ports at all ..............well its probably not the one your gonna be depending on to retrieve those special documents anyway. One last thing... if it has a USB port, it probably has plug and play.

I respectfully disagree...identity theft is a VERY big deal. It can go undetected for months or years, even with the victim being vigilant. The last person we convicted in this area made a six-figure income from it for several years. Part of her plea agreement was to make a police training video on how she did it. The video is two hours long, and only scratches the surface.

After a local disaster, your personal information may be scattered everywhere, but not by you! How well does your landlord or the store up the street maintain your personal information?

I agree with you that, like your wallet, you should not loose your USB drive (or have it taken from you), if possible. But that is not always possible under all circumstances.

This is one of my investigative specialties. If anyone is interested in learning more, send me a PM, and I will attempt to assist you. And no, you don't need to provide me your personal data! <img src="/images/graemlins/grin.gif" alt="" />

Having a working credit card (and perhaps the ability to access additional credit) would seem to me to be a vital survival tool. Not as sexy as knives, fire starters, and flashlights however!

Given the vast amount of space available, I'd include friends addresses, and a complete phone list ( friends, family, work, back-up numbers Hey what the alternative number for 911 in your area buckaroo?) Got your kids school number on there? your neighbor, your plumber, doc?

Photos of your house, serial numbers of your expensive gear -- for insurance.

A city map. Your Prescriptions. ( glasses, too!) A basic first aid text.

Keep thinking on this one,

TRO

PS you might also consider backing up your information at a remote site -- a relatives, for instance

Now no need in trying to change the focus of what i was trying to make a point about...............i agree its a huge ordeal if it happens...........but one can take simple measures to advoid it. What i get tired of hearing is people saying becareful it could happen to you. No one ever says hey thats a growing issue lets discuss ways to prevent it!
Knowledge is the first step in prevention, and its all a part of being truly EQUIPPED!
-you did mention "go for years unnoticed" -your bank can do simple credit checks and social/name linking with open accounts at the click of a computer......and its usually free if you just ask!

Speaking of inventorying your home. The "Insurance Information Institute" has a free software program to inventory your home. It is "Know Your Stuff". Glock-A-Roo originally told the forum about the software in this thread.

Being the paranoid, nothing is for free type of guy - I checked out the organization. "III attempts to improve public understanding of insurance -- what it does and how it works. The site is subdivided into sections for "Individuals" (consumer info) "Media" (press info). [some content available in Spanish]"

I had previously downloaded the software. Going to use it with the digital camera I am giving my wife for Christmas. Then I'm going to try and inventory my mother's home.

I like the statement from the download page.
"Please note that the I.I.I. is providing this electronic home inventory for you to install on your computer. To safeguard your privacy, the I.I.I. will not have access to your personal home inventory files. It is your responsibility to save your home inventory in a secure location." {such as a USB drive}

*** STANDARD DISCLAIMER *** I am not affliated with III.org by employment nor commerce. Opinions stated are my own and definitely not that of my employer. No garauntees as to your satisfaction with use of this product are stated nor implied by me. Any symbolism to persons living, dead, or undead is circumstantial. TANSTAAFL & YMMV. And if all else fails, I'll blame it on Glock-A-Roo. <img src="/images/graemlins/grin.gif" alt="" />

Ben

One thing I have learned over the years is to never bother with these free downloads from companies or organizations unless they are a well supported open source project. What usually happens is after 5 or so years you can't find that program anymore for download and you find out it won't work on someone else's system because the manufacturer never tested with with all versions of windows. Keep your documents in the most basic of formats, plain text, csv, etc. Don't even trust programs such as Microsoft Office even though they see to be very popular as they have dropped support for some of their older file versions in the past.

Agree with Eugene. I prefer the most basic of formats that can be loaded up ANY system or software. I remember having data on an old MAC. The word processing and spreadsheets files transfered to Windows platforms easily but the other data written by specialized software had to be left out.No way of transfering them.

That was an eye opener.

However, having said that, it seems that most people have MS Word & Excel. And so it would seem safe enough to assume they would be there in some time.

I save webpages like this one as an MHTML ( the web-ARCHIVE format ) , that allows saving everything in it in one file, instaed of using htm, or html format that saves the webpages in one file plus one folder for images. I hope those single-file archives would be reable for some time.

MHT archives are not that complex, they're just MIME envelopes combining the HTML file with the resources (images etc) that it needs. MIME envelope format is well documented in internet standards. Right now Firefox doesn't support MHT but there's some active feature requests to support it, so maybe it will be added sometime. At worst though, it's not hard to write a script that expands an MHT into a directory of separate files that Firefox can read. The closed web format I really hate is Flash animations, since they are all over the place now, and it's sometimes impossible to navigate past them without the plug-in.

A lot of people make that assumption about MS word and excel but I have run into compatibility problems in both so I avoid MS word and excel now as well.

I totally agree about flash.
And what realy p*&^%&^s me is that down here we are limited to slow internet connections in a lot of area's and flash animations seems to use all the bandwidth to slow everything to almost a halt.

As a computer support geek - I frankly don't trust any computer (hardware) or application (software) and some times I am not to sure about my memory (wetware) - sorry, nerd joke.

I just like the fact that you can consolidate your information (picture of item, picture of receipt and description) about an item and then PRINT it out. Only thing that has been around longer than papyrus is clay tablets and they don't feed through the laser printer very well - OK, enough of the nerd jokes...

In the past year+ there has been a lot of news reports regarding e-mail and its use in legal arguements. Businesses are now being required to retain data for years (costly and not as easy as it sounds). Conversely, I was going through some of my father's papers and found letters from the 1940s where he was making arrangements to come home and visit with friends. Hand-written on good old paper. Also his Naval and Air Force discharge paperwork.

Keep hard copies of your data. Those USB keys are not good for long term storage - just darn easy to transfer data from one computer to another.

OK - how can I get this back on topic so I don't get thumped by Chris. Be sure and store your printouts (and the USB key) in a secure location ready to go when you are bugging out. Tornados are one of the planning scenarios for our area and that USB key is going to be hard to find amid all the kindling that used to be your house. Of course, any paperwork left behind will only be found _Somewhere Over the Rainbow_ . <img src="/images/graemlins/smile.gif" alt="" />

Ben

I too have been lurking for a while, but thought this was a good opportunity to post. I've been giving this one some thought for a while. As a computer geek I realize just how vulnerable these things can be. Despite some previous posts, identity theft is a real issue, especially with all of your personal data in one place.

I've been mulling over an emergency USB key with all of my info encrypted with something like PGP (which can incidentally do data wiping). However, without an available kill-switch which would delete data upon an attempt to copy/decipher the encrypted content, it will be fairly vulnerable if it falls into the wrong hands, a real possibility in a disaster oremergency or of course with the more likely theft or loss.

I've been thinking of a modified strategy where I store the basic information on USB that MOST IMPORTANTLY would be CONVENIENT to have handy and yet not able to compromise my security. As an addition, storing the remainder in encrypted file format on my google or yahoo email account (as draft, etc.) would keep it behind my email password as well as encrypted. I would also recommend hiding it via deceptive file naming.

For things like this it's important to have your secured info availble to your spouse and probably a really good friend or two, or at least your lawyer.

Anyway, some things you could keep hand on USB - all in plaintext form so you or others can retrieve it:
1) House Inventory with serial numbers and any special insurance info.
2) Emergency contact Information (Insurance agencies, emergency agencies, police, fire, area hospitals, news broadcast stations, radio frequencies, etc.)
3) Contact numbers for friends and family, your kids' school numbers, work number.
4) Current prescriptions, allergies, medical conditions such as diabetes, etc. This is so you can potentially get prescriptions refilled and so medical personnel or emergency personnel can get it if needed. Eyeglass/contact info would be handy too.
5) Stationary image maps / Mapping software with preloaded maps - all important locales and routes preplanned and marked. Paper version of this probably should be part of a BOB as well as car and hiking kits. I'll assume it's in any aircraft...
6) (potentially encrypted) file with a pre-paid credit card loaded with at least $250 (American Express). This, even if stolen can't go past the amount listed, and I think you can get them without personal info tied to them.... a similar idea is an emergency gas card number, area hotel gift card number, pre-paid phone card, etc. Even Travelers Cheques numbers which you could claim as destroyed/lost and have them replaced wherever you arrive.
7) Candid pictures of yourself and your family with your names printed with the picture - use ones which could not conceivably be hacked into a fake ID like a Drivers license, etc. - slightly at angle, not complete face shot, etc.

Any other non-personal information that's likely to be needed by you or those who find you (hopefully alive if not conscious).

*****

Some things for your Google or Yahoo or other web-accessible email. I recommend keeping it at more than one in case one goes down:
1) Medical Records with social security number tied to them. Plain text will do, but scanned in with MRIs, X-Rays, etc. would be good.
2) SSN (Social Security Number for those overseas) - whatever your National ID card is. - Scanned in.
3) Drivers License - Scanned in.
4) State ID Card - Scanned in.
5) Savings, Checking, Credit Card and Home Safe combination numbers
6) Marriage License and Birth Certificates - Scanned in.
7) Passports - Scanned in.
8) School certificates - although I can't think of any time you'd need this, except perhaps doctors or emergency personnel to prove their bona fides. That means you should also include copies of any certificates you hold along with the contact information of your certification board.

Any other sensitive financial or identification information for which you might have a need.

My point here is that anything on the keyfob should be virtually unusable, even should it fall into "enemy" hands. Thus anything you'd feel uncomfortable leaving around unencrypted in public shouldn't go on here. Anything that you would encrypt should have no ties to your personal data or be a conduit for a crook to retrieve that information based on what's on the key.

I don't think it's excessively paranoid to think that keeping your account and personal info secure is a good thing. If I have your home phone and a clean copy of your birth certificate, I could effectively become you in a matter of hours, opening new accounts, wiping out your existing balances and I'm not exactly schooled in the methods. For a real crook, I would think the less they have the better!

Nice post and good suggestions. And welcome!

My only thought is that scanning important ID's and paperwork to be stored in an e-mail account could present a threat to your privacy.

Couldn't the image files (.jpg, .gif, etc.) be kept in the local computer's internet cache folder? I could see this being a potential problem if you happened to access your e-mail message in a public setting such as on a library computer.

Yes, they would.

Email, even on the server, is a lot less secure than an unencrypted thumbdrive on your person.

Agreed. I operate under the presumption that you have access to multiple machines in several time zones like me... :-) Actually, more to the point, one thing I would almost certainly put on my USB key is a fully functional operating browser like Firefox. I plug in the key, use my browser (with all of my personized settings) and never really worry about the cache since I can put it on the fob or disable caching entirely. One other option, and a good one if you have access to boot a machine, is to put a small Linux Distro on your USB key, make it bootable, and then you operate entirely on your own personal OS. Of course, if you are pulling that information down through a proxy server or some other untrusted place, then do this (which I really didn't make clear): compress all your files into one file, encrypt it, and attach this encrypted file to a draft email document - or send it to yourself so it's in your inbox.

Thanks - nice to make myself visible after reading for several weeks. And good pickup. I sort of glossed over this. I didn't intend for anyone to put those images directly into an email document that has the potential of being cached.

Personally, I go with both the bootable Linux as well as carrying around my own Firefox environment.
Portable Firefox is a good place to start. I recommend Damn Small Linux or
Slax, but there are many fine Live Linux Distros that will work great depending on the size of your key.

Edit: One other thing... I'm not sure that storing files on Google or Yahoo (especially encrypted ones) constitutes a larger security breach than an unencrypted USB key. They are easy to lose, break or drown and the web option keeps your secure data behind the login of a secured email system. I've operated mine for years without any problems whatsoever and they are there even should my USB key not make it out alive. :-)

I would suggest:

1. Making sure it is formatted to FAT32
(this can be read by PC's, Macs, and Linux! <img src="/images/graemlins/smile.gif" alt="" />)

2. Using .txt or .rtf file types
(these are generic, better to stay away from .doc)

3. Survival information
(ex: http://www.ki4u.com/survive/myth11.htm )

4. Information and How-to guides telling how to FIX THINGS.
(Stuff on cars, machines, batteries, GENERATORS, COMPUTERS)




Hope this helps <img src="/images/graemlins/smile.gif" alt="" />

Here's what I keep:
Bank Account #s, Bank phones
Contacts list and PLAN of Contact with
Evacuation - rendevous Plans
Credit card account and cust. svc. #s
Driv. Lic / Passports
Home inventory/Photos in 5mpix. resolution
(I've confirmed that I can zoom in on all serial #s)
Insurance documents & Ins. Co. Phone #s
Investment account numbers
Titles and Deeds
Wills and Durable/Healthcare Power of Attorney

I do not worry about the data format, because I think these need to be updated frequently anyway. I use .pdf for documents and .jpeg for the photos. I have verified they are viewable and printable on multiple platforms, and I doubt that these formats will become obsolete without my knowledge (and plenty of time to change formats).

They are encrypted using a symetrical public key program, and anyone I would want to be able to access them can. Storage is as follows:
One set burned to DVD and sent to a family member out of town. One set burned to a DVD and stored in my cache. One set is uploaded to my internet email account.

And I feel paranoid doing all that!

Several posters have reference encryption on a USB drive. My recently purchased SanDisk Cruzer includes a bundled (free) version of CruzerLock software for encryption licensed from encryptX. It's a proprietary bit of software with a simple password and easy to use. Perhaps not as secure as a PGP solution (or maybe it is, there's not much technical data provided), but it's simple enough for those intimidated by a more technical solution.

Anyone have any experience with this software?

Willie, I think what you're using makes one big packet of all the data and folders and actually encrypts or locks the USB device. That isn't what I'm using. I use

http://www.kryptel.com/products/skey/?from=sk

Each file is encrypted, with a "decryption" program front-end so the recepient does not have to have any particular software to decrypt... just the password. IMHO this is not as platform-dependent as other methods.

The main thing you want to think about is decrypting your data if needed. Can you download the decryption software on a friends pc? When you find out the survivor check in station is at a school and they only have mac's can you decrypt the data? Or you bug out to the grandparents and the only pc is a P100 running windows 95 (no USB).
Just a few things to think about.

"The main thing you want to think about is decrypting your data if needed. Can you download the decryption software on a friends pc? When you find out the survivor check in station is at a school and they only have mac's can you decrypt the data? Or you bug out to the grandparents and the only pc is a P100 running windows 95 (no USB)."

That is why I am really surprised not to have ever seen a laptop on the BOB lists on this forum. It seems to me to be a pretty crucial piece of hardware. At least as important as a GPS.

Vendor supplied encryption programs tend to be not very secure. For something like this, assuming the security is to protect against random crooks rather than against (say) the FBI, moderate security might be ok.

If you're willing to trust moderate security, I'd probably just use password protected zip files with (if you're using wndows) winzip 9.0 or later, if I have it right (the earlier password system was much less secure).

If you want higher security, use PGP/GPG. Include a copy of the program (unencrypted) on the USB key itself, preferably a DOS command line version (that will run on just about any PC). You might even include an image of a bootable MSDOS floppy disc that includes command line PGP. If you have any way to read the USB drive, you can probably find a PC somewhere that can boot the floppy.

Keep in mind that the PC you use it on might not be secure. For example, if you use a PC in a government operated shelter, it might be recording all your keystrokes including your passphrase. Again, depending on the type of content on the USB drive, that might or might not bother you.

My laptop isn't part of my bob but it will go with me if I would ever need to bug out. I carry it to work and back since work is only using lotus notes we don't have any kind of reliable calendar system so my laptop is basically my pda/pim/planner. I made sure buy a small lightweight business model so it would be easy to carry and last a good long time.

You still run into the issue of that decryption program only being able to run on a pc. I went to a client site once and it was a small school that only had Mac's and one windows server that was down and I needed to extract a raid controller driver which was in a self extracting zip, luckily I had my own laptop so I could extract this zip file since none of their systems could.

One thing I found was I do not have Administrative access on the computer I use at work and I cannot install a program. I can access my USB drive but not the security software on it. I have since found that most "public" access computers are set up the same. I have gone to password protecting the files rather than taking the chance of not being able to decrypt. Not as secure but if I can't get the data when I need it there is not much use carrying it.

You could include a macintosh version of the decryption program if you wanted. They're downloadable from the same types of places as the pc programs.

Hi, this is my first post, so hopefully this makes some sense.

A great encryption program is truecrypt. Available at http://www.truecrypt.org it is open source, it is free and runs on window and linux. Here are some of it's features.

Main Features:
* Creates a virtual encrypted disk within a file and mounts it as a real disk.
* Encrypts an entire hard disk partition or a device, such as USB flash drive.
* Encryption is automatic, real-time (on-the-fly) and transparent.
* Provides two levels of plausible deniability, in case an adversary forces you to reveal the password:
1) Hidden volume (steganography)
2) No TrueCrypt volume can be identified (volumes cannot be distinguished from random data).
* Encryption algorithms: AES-256, Blowfish (448-bit key), CAST5, Serpent, Triple DES, and Twofish.
Mode of operation: LRW (CBC supported as legacy).
* Based on Encryption for the Masses (E4M) 2.02a, conceived in 1997.

On my usb drive I created a standard volume within a file that uses about half of the drive, this leaves room for emergency contact information/medical information that I would want someone to see if I were in an accident. It can be run directly from the usb drive and does not leave behind any traces on the PC. As long as you have a strong pass phrase, decrypting the volume would be very difficult if not impossible.

I also use another open source piece of software called keypass, a password manager available at http://keepass.sourceforge.net . I use this to store all of my passwords, It can also be run directly of of the USB drive without anything being written to on the client PC. It is also highly encrypted and is as secure as your pass phrase.

If you want to be extremely secure/paranoid with your pass phrases. You can get cryptographic-strength random password strings from http://www.grc.com/password. Just copy the number of characters you need/want your passord to be (the longer the better) and save them in keepass. I use full 63 character "passwords" for my more secure files. It can be a hastle, but security always is.

Mostly I just want to make sure that if someone were to find/take my usb drive they will have one of two options. Contact me with the emergency contact intormation on the drive and return it, or realize that there is nothing "good" on it for them and reformat it to use as their own.

There are also some other great open source programs out there like portable openoffice and portable firefox.

If I was unclear about anything, let me know.