On Mon, 7 Mar 2011, Stephan Somogyi wrote: > AFAIK, SSD controllers don't (yet?) dedup. Even if they did, a 1 > byte change within a block would cause a new block to be written. So > you end up with n instances of very similar blocks. Absent the phys > to log mapping from the controller, you wind up having to try a > large number of combinations to work out what the most recent > version of a file actually contained.
Many forensic-worthy files (e.g., images and text documents) are never actually changed: most files are just downloaded and even if the user edits and saves a file, in reality the editor each time creates a new file and remove the previous one. Of course, databases and swap-files are different. -- Regards, ASK _______________________________________________ cryptography mailing list [email protected] http://lists.randombit.net/mailman/listinfo/cryptography
