Abstract
In this chapter, we forensically examine three different solid state drives (SSDs) from three different manufacturers using three commercial digital forensic tools and one open source forensic tools, and report on the findings of the analysis.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Solid State/Hard drive differences: D F I News. https://search-proquest-com.libweb.lib.utsa.edu/docview/1626732768 (2014)
Micron: An introduction to NAND flash and how to design it in to your next product. NAND Flash 101, 27. https://ece.umd.edu/~blj/CS-590.26/micron-tn2919.pdf (2006)
Gubanov, Y., Afonin, O.: Recovering evidence from SSD drives: understanding TRIM, garbage collection, and exclusions. D F I News. https://search-proquest-com.libweb.lib.utsa.edu/docview/1613504182 (2014)
Crump, G.: Flash storage has special security needs. Informationweek. https://search-proquest-com.libweb.lib.utsa.edu/docview/1437266763?accountid=7122 (2013)
Bonetti, G., Viglione, M., Frossi, A., Maggi, F., Zanero, S.: Black-box forensic and antiforensic characteristics of solid-state drives. J. Comput. Virol. Hacking Tech. 10(4), 255–271 (n.d.). https://doi.org/10.1007/s11416-014-0221-z
Fulton, J.W.: Solid state disk forensics: Is there a path forward? (Order No. 1555597). Criminal Justice Database; ProQuest Dissertations and Theses Global (1534359347). https://search-proquest-com.libweb.lib.utsa.edu/docview/1534359347?accountid=7122 (2014)
King, C., Vidas, T.: Empirical analysis of solid state disk data retention when used with contemporary operating systems. Digit. Investig. 8(2011), S111–S117. http://www.sciencedirect.com/science/article/pii/S1742287611000375 (2011)
Intel SSD Image: Intel SSD 330 series 180 GB. https://images-na.ssl-images-amazon.com/images/I/71VVSWNNxoL._SX425_.jpg. Accessed 14 Nov 2018
Patriot SSD Image: Patriot 120 GB. https://c1.neweggimages.com/NeweggImage/ProductImage/20-225-081-Z01.jpg. Accessed 14 Nov 2018
Crucial SSD Image: Crucial BX500 120 GB. https://img.bfmtv.com/c/630/420/b17/f8f244eccb926c4f398ed91c680fc.jpg. Accessed 14 Nov 2018
Sabrent USB-to-SATA Adaptor Image: Sabrent EC-SSHD 2.5” USB 3.0 to SSD SATA Hard Drive Adapter. https://www.sabrent.com/uploads/EC-SSHD-Main.jpg. Accessed 14 Nov 2018
HowtoForge: Converting a VMware Image to a physical machine. https://www.howtoforge.com/converting-a-vmware-image-to-a-physical-machine. Accessed 20 Oct 2018
AccessData Logo Image: https://accessdata.com/assets/images/logo.png. Accessed 14 Nov 2018
EnCase Logo Image: https://www.guidancesoftware.com/docs/default-source/brand/ef-lockup-2colorba91e5f7beb06108b3ffff0100c79052.png?sfvrsn=2. Accessed 14 Nov 2018
Autopsy Logo Image: https://www.autopsy.com/wp-content/uploads/sites/8/2016/02/autopsy-logo-head.svg. Accessed 14 Nov 2018
SC Media SC Magazine: Product information AccessData Forensic Toolkit (FTK), 3 October 2016. https://www.scmagazine.com/review/accessdata-forensic-toolkit-ftk/. Accessed 14 Nov 2018
Digital Intelligence: EnCase forensic V8 + 1 year subscription. https://digitalintelligence.com/store/products/s5300. Accessed 14 Nov 2018
Tittel, Ed., Lindros, K.: Best Digital Forensics Certifications. https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html. Accessed 14 Nov 2018
opentext: Training Packages. https://www.opentext.com/products-and-solutions/services/training-and-learning-services/course-catalogue/encase-training/training-packages. Accessed 14 Nov 2018
Autopsy: Training in autopsy. https://www.autopsy.com/training/. Accessed 14 Nov 2018
Choo, R.: AccessData Forensic Toolkit (FTK) v6.4 lecture slides. https://utsa.blackboard.com/bbcswebdav/pid-3326004-dt-content-rid-51345344_1/xid-51345344_1. Accessed 20 Oct 2018
Roussev, V., Richard III, G.G.: Breaking the performance wall: the case for distributed digital forensics. In: Proceedings of the 2004 Digital Forensics Research Workshop, vol. 94. http://www.academia.edu/download/30684064/Golden-Perfromance.pdf (2004). Accessed 14 Nov 2018
Forensic Computers Incorporated: Forensic tower IV X10 dual xeon. https://www.forensiccomputers.com/forensic-tower-iv-x10.html. Accessed 14 Nov 2018
AccessData: AD LAB: large-scale investigation and processing. https://accessdata.com/products-services/ad-lab. Accessed 14 Nov 2018
Black, M.E.: The impact of solid-state drives on digital forensic investigations: a case study (Order No. 3737151). ProQuest Dissertations and Theses Global (1747435217) (2015). https://login.libweb.lib.utsa.edu/login?url=https://search-proquest-com.libweb.lib.utsa.edu/docview/1747435217?accountid=7122
Cornwell, M.: Anatomy of a solid-state drive. Commun. ACM, 55(12), 59–63 (n.d.). https://doi.org/10.1145/2380656.2380672
Gubanov, Y.: Retrieving digital evidence methods, techniques, and issues, 14 June 2016. https://www.forensicmag.com/article/2012/05/retrieving-digital-evidence-methods-techniques-and-issues. Accessed 14 Oct 2018
Remo Software: How to choose the most effective SSD data recovery technique. Remo Hard Drive Recovery Software, 6. https://www.remosoftware.com/ssd-data-recovery-techniques (2018)
Micheloni, R.: Solid-State Drive (SSD): a nonvolatile storage system. Proc. IEEE 105(4), 583–588 (n.d.). https://doi.org/10.1109/JPROC.2017.2678018
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this chapter
Cite this chapter
Gibson, M., Medina, N., Nail, Z. (2020). SSD Forensics: Evidence Generation and Analysis. In: Zhang, X., Choo, KK. (eds) Digital Forensic Education. Studies in Big Data, vol 61. Springer, Cham. https://doi.org/10.1007/978-3-030-23547-5_11
Download citation
DOI: https://doi.org/10.1007/978-3-030-23547-5_11
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-23546-8
Online ISBN: 978-3-030-23547-5
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)