Formatting should erase everything.  If you want to be extra careful you can encrypt a USB drive.  I start out with a machine that has no significant personal info but connects to the internet which then checks for viruses, trojans, and other malware.  Then anything I need from the internet is brought from a USB drive to my unconnected machine.  This transfer is always one direction.  Never do I transfer anything from the private machine to the internet connected machine.  If I have to do the latter, such as passwords, then I write it out on a piece of paper and type it into a masked field.  My keystrokes are encrypted using Zemana Antilogger, so this latter method should be safe.