Thanks for this pointer. I had a look at it, very interesting. The
explanations of the SSD storage technology are well written.
Basically, SSD controllers have a (kind of) garbage collection process
acting on its own, e.g. when the device is powered on. This is useful
for the user. Law enforcement agencies are losing the ability to recover
deleted files as arguable court evidence. Nothing "catastrophic" since
the deleted file recovery feature is by accident in the other storage
technologies.
--
- Thierry Moreau
Alexander Klimov wrote:
It is also harder to rely on SSD as evidence.
<http://www.jdfsl.org/subscriptions/JDFSL-V5N3-Bell.pdf>
Digital evidence is increasingly relied upon in computer
forensic examinations and legal proceedings in the modern
courtroom. The primary storage technology used for digital
information has remained constant over the last two decades,
in the form of the magnetic disc. Consequently,
investigative, forensic, and judicial procedures are
well-established for magnetic disc storage devices (Carrier,
2005). However, a paradigm shift has taken place in technology
storage and complex, transistor-based devices for primary
storage are now increasingly common. Most people are aware of
the transition from portable magnetic floppy discs to portable
USB transistor flash devices, yet the transition from magnetic
hard drives to solid-state drives inside modern computers has
so far attracted very little attention from the research
community.
Here we show that it is imprudent and potentially reckless to
rely on existing evidence collection processes and procedures,
and we demonstrate that conventional assumptions about the
behaviour of storage media are no longer valid. In particular,
we demonstrate that modern storage devices can operate under
their own volition in the absence of computer instructions.
Such operations are highly destructive of traditionally
recoverable data. This can contaminate evidence; can
obfuscate and make validation of digital evidence reports
difficult; can complicate the process of live and dead
analysis recovery; and can complicate and frustrate the post
recovery forensic analysis.
Our experimental findings demonstrate that solid-state drives
(SSDs) have the capacity to destroy evidence catastrophically
under their own volition, in the absence of specific
instructions to do so from a computer.
_______________________________________________
cryptography mailing list
[email protected]
http://lists.randombit.net/mailman/listinfo/cryptography
