The Dilemma of SSDs #Forensics So, you took mirrors of an SSD to preserve #evidence. Only to find out that #hashing was unmatched? Solid-State Drives have a limited number of writes and as a result, will need two different capabilities that are used to help reduce the overall wear of the SSD: 1. Performance #Trimining: an ATA command issued by the operating system to inform the SSD which blocks of data are no longer in use. When a file is deleted or modified, the operating system sends a Trim command to the SSD, indicating that the associated blocks can be erased in advance during the garbage collection process. By doing this, the SSD can proactively clean up and prepare those blocks for future write operations, resulting in improved performance and longevity. 2. #Wear Leveling: When content is changed, it must first be moved to a new location before the data can be saved, and then the data will be slacked in the garbage collection queue. Once the data has been moved, the original locations is then free to be cleaned. The data on SSD is #virtualized, and the sectors are #logical and not physical [constantly changes]. Every 5 write cycles, the data is moved to a new empty block. This destroys some #forensics data like file slack. Most SSDs will also auto-repair the drive from sudden power loss, adding additional #artifacts. Normal Shutdown operations can also lead to the above outcome. In short, the best way to acquire SSD is by doing #live acquisition [similar to #memory acquisition]. #digitalforensics #incidentresponse #soc
Yuri Gubanov
9mo
It is not quite clear if live acquisition is always the best option. For unencrypted drives chip-off or its low level analogues may bring better results.
C|CISO | Senior Consultant - Digital Forensics & Incident Response | Ex- Abu Dhabi Police | ECIHv2 | CHFI | CCNA | MCSE | MCSA | MCP | EC-Council Honor Board | DFIR Faculty | PhD Scholar
9moWhen TRIM is enabled, it might take few minute or lesser than a minute until the data is gone (by the time one decides to conduct live acquisition). Also the duration depends on the controller manufacturer. Most SSD’s have multi core structure that can do multiple tasks at a time. Once OS issues TRIM command, even turning off the system will not help to stop the TRIM operation in the controller. This technology is to enhance the SSD’s life and the manufacturers are least bothered on forensic applicability. Enormous studies have been conducted on SSD forensics and most work concluded that its a dead end.