Challenges of SSD Forensic Analysis - Digital Assembly

Recommendations

Info

Once you DISCARD/UNMAP sector X, the device can return any state on the next read of that sector, but must continue to return that data until sector is rewritten Latest draft: If TPRZ bit set then the return for an unmapped block is always zero. If TPRZ isn't set, it's undefined but consistent.
Hard to read data off chips directly Even if you do, hard to make sense of it Requires some very sophisticated carving technology Needs to be content based SmartCarving?
Page 1 and 2: Nasir Memon - Polytechnic Institute
Page 3 and 4: Overview SSD’s are fairly new to
Page 5 and 6: 2.5” SATA 3.8Gbps SSD 2.5” SATA
Page 7 and 8: Flash Memory NOR Flash vs. NAND Fl
Page 9 and 10: SLC NAND Flash (x8) MLC NAND FLASH
Page 11 and 12: Implementation Overview
Page 13 and 14: Manufacturers can use any kind of i
Page 15 and 16: Pages are basic programmable units
Page 17 and 18: Block: 64 Pages … … 512 Bytes 1
Page 19 and 20: Basic Algorithms Source: Micron TN-
Page 21 and 22: Spread the drive wear across the en
Page 23 and 24: Dynamic When allocating blocks, ch
Page 26 and 27: http://www.insidehw.com/Reviews/Sto
Page 28 and 29: IO Microcontroller Intel PC29AS21AA
Page 31 and 32: IDE interface allows logical data r
Page 33: As soon as you do a write, a block

Challenges of SSD Forensic Analysis - Digital Assembly

Create successful ePaper yourself

Delete template?

Save as template?