Challenges of SSD Forensic Analysis - Digital Assembly

Recommendations

Info

Wear leveling algorithms fragment data on the drive, but in an unpredictable way (non-‐ standard) NAND flash technology in <strong>SSD</strong>s, doesn’t allow for the same forensics tricks to be used as with HDDs Drive has spare blocks which cannot be read. X25 -‐ 7% to 8%. Even more in enterprise version. Mostly no slack space as entire block erased before write Garbage collection clears blocks marked for “deletion” ▪ Turn the hard drive <strong>of</strong>f to prevent garbage collection
As soon as you do a write, a block gets allocated and always stays allocated. When you delete a file, it is only "deleted" in the file system, but the hard drive block stays allocated. The trim command is proposed so that the hard drive microcontroller knows to also deallocate the block (free it.)
Page 1 and 2: Nasir Memon - Polytechnic Institute
Page 3 and 4: Overview SSD’s are fairly new to
Page 5 and 6: 2.5” SATA 3.8Gbps SSD 2.5” SATA
Page 7 and 8: Flash Memory NOR Flash vs. NAND Fl
Page 9 and 10: SLC NAND Flash (x8) MLC NAND FLASH
Page 11 and 12: Implementation Overview
Page 13 and 14: Manufacturers can use any kind of i
Page 15 and 16: Pages are basic programmable units
Page 17 and 18: Block: 64 Pages … … 512 Bytes 1
Page 19 and 20: Basic Algorithms Source: Micron TN-
Page 21 and 22: Spread the drive wear across the en
Page 23 and 24: Dynamic When allocating blocks, ch
Page 26 and 27: http://www.insidehw.com/Reviews/Sto
Page 28 and 29: IO Microcontroller Intel PC29AS21AA
Page 31: IDE interface allows logical data r
Page 35 and 36: Hard to read data off chips directl

Challenges of SSD Forensic Analysis - Digital Assembly

Create successful ePaper yourself

Delete template?

Save as template?