Abstract
Extracting useful information from Solid State Drives (SSD) is a challenging but important forensic task. However, there are opposing views [14, 15, 22] that (1) SSDs destroy the forensics evidences automatically and (2) even after sanitization of SSDs, data can be recovered. This paper investigates this issue and reports experimental findings that identify the reason why certain SSDs seem to destroy forensic evidences while other SSDs do not. The experiments provide insight and analyses of the behaviour of SSDs when certain software components, such as Background Garbage Collector (BGC) and Operating System functions, such as TRIM, are executed on the SSD.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Lofgren, K.M.J., Norman, R.D., Thelin, G.B., Gupta, A.: Wear leveling techniques for flash EEPROM systems, 8 May 2001 (U.S. Patent 6,230,233)
Flusche, K.J.: Computer forensic case study: espionage, Part 1 just finding the file is not enough!. Inf. Syst. Secur. 10(1), 1–10 (2001)
Janes, S.: The role of technology in computer forensic investigations. Inf. Secur. Tech. Rep. 5(2), 43–50 (2000)
Guide, N., Ashcroft, J., Electronic Crime Scene Investigation: A Guide for First Responders Series: NIJ Guide
Carrier, B., Spafford, E.H.: Getting physical with the digital investigation process. Int. J. Digital Evid. 2(2), 1–20 (2003)
Boddington, R., Hobbs, V., Mann, G.: Validating digital evidence for legal argument (2008)
Berg, E.C.: Legal ramifications of digital imaging in law enforcement. Forensic Science Communications, 2(4) (2000)
Kenneally, E.E., Brown, C.L.: Risk sensitive digital evidence collection. Digital Investig. 2(2), 101–119 (2005)
Carrier, B.: File System Forensic Analysis, vol. 3. Addison-Wesley, Boston (2005)
Kasavajhala, V.: Solid State Drive vs. Hard Disk Drive Price and Performance Study, Dell Technical White Paper, Dell Power Vault Storage Systems (2011)
Hu, X.Y., et al.: Write amplification analysis in flash-based solid state drives. In: Proceedings of SYSTOR 2009, The Israeli Experimental Systems Conference. ACM (2009)
Lee, J., et al.: A semi-preemptive garbage collector for solid state drives. In: IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS). IEEE (2011)
Seppanen, E., O’Keefe, M.T., Lilja, D.J.: High performance solid state storage under linux. In: IEEE 26th Symposium on Mass Storage Systems and Technologies (MSST). IEEE (2010)
Bell, G.B., Boddington, R.: Solid state drives: the beginning of the end for current practice in digital forensic recovery? J. Digital Forensics Secur. Law 5(3), 1–20 (2010)
Freeman, M., Woodward, A.: Secure state deletion: testing the efficacy and integrity of secure deletion tools on Solid State Drives. In: Australian Digital Forensics Conference (2009)
Olson, A.R., Langlois, D.J.: Solid state drives data reliability and lifetime. Imation White Paper (2008)
Agrawal, N., et al.: Design Tradeoffs for SSD Performance. In: USENIX Annual Technical Conference (2008)
Chen, F., Koufaty, D.A., Zhang, X.: Understanding intrinsic characteristics and system implications of flash memory based solid state drives. In: Proceedings of the eleventh international joint conference on Measurement and Modeling of Computer Systems. ACM (2009)
Garfinkel, S.L.: Digital forensics research: the next 10 years. Digital Invest. 7, S64–S73 (2010)
Luck, J., Stokes, M.: An integrated approach to recovering deleted files from NAND flash data. Small Scale Digital Device Forensics J. 2(1), 1941–6164 (2008)
Roberts, D., Kgil, T., Mudge, T.: Integrating NAND flash devices onto servers. Commun. ACM 52(4), 98–103 (2009)
Wei, M.Y.C., et al.: Reliably erasing data from flash-based solid state drives. In: Proceeding FAST (2011)
Arthur, K.K., Venter, H.S.: An investigation into computer forensic tools. In: Proceeding ISSA (2004)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2015 Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
About this paper
Cite this paper
Shah, Z., Mahmood, A.N., Slay, J. (2015). Forensic Potentials of Solid State Drives. In: Tian, J., Jing, J., Srivatsa, M. (eds) International Conference on Security and Privacy in Communication Networks. SecureComm 2014. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 153. Springer, Cham. https://doi.org/10.1007/978-3-319-23802-9_11
Download citation
DOI: https://doi.org/10.1007/978-3-319-23802-9_11
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-23801-2
Online ISBN: 978-3-319-23802-9
eBook Packages: Computer ScienceComputer Science (R0)