At 15:59 +1300 08.03.2011, Peter Gutmann wrote:
Sure, but that's why you're paying five-figure sums for the forensics boxes. They already do this for pretty much every cellphone type under the sun, so as soon as the demand emerges they'll do SSDs as well.
Given the size difference between most phones and SSDs, that's a combinatorially rather different prospect. I'm not saying that it's impossible, just that the SSD case requires a lot more motivation to complete.
In addition the magic in wear-levelling is where to move things to, when, and how, not in any magic re-encoding of block data.
Agreed, but I don't think I implied otherwise.
So the contents of the data blocks stay the same, they're just in different locations.
With load levelling you get identical or near-identical blocks strewn throughout the flash as files are rewritten. This is what I was referring to when I said that figuring out the blocks containing the most current file data is tricky.
AFAIK, SSD controllers don't (yet?) dedup. Even if they did, a 1 byte change within a block would cause a new block to be written. So you end up with n instances of very similar blocks. Absent the phys to log mapping from the controller, you wind up having to try a large number of combinations to work out what the most recent version of a file actually contained.
This means that, once you exclude metadata used by the FTL, what you'll see is the equivalent of a highly-fragmented standard disk drive. I'm not saying it'll be trivial, but it shouldn't be that hard either.
One of the really big differences between raw flash from an SSD and a magnetic hard drive is that rewriting a file on an HD will overwrite the blocks -- insert handwave about modern copy-on-write filesystems here -- whereas on an SSD it won't.
Which brings us back to puzzle-piece together-putting on a nonsmall scale. s. _______________________________________________ cryptography mailing list [email protected] http://lists.randombit.net/mailman/listinfo/cryptography
