±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 0
Overall: 27628
Visitors: 62

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

SSD Forensics

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next 
  

Re: SSD Forensics

Post Posted: Sat Nov 17, 2012 9:59 am

- gmlw0908
He is my boyfriend, we both studied BSc (Hons) Forensic Computing so yes he does know.

Thank you for your concern...


You are welcome Smile , I am sure a lot of e-mail harvester will appreciate this.

Just in case, besides the opportunity of posting a third-party e-mail address on a public forum, it is not particularly "smart" (unless you are putting together an e-mail spam honeypot) to publish on a public forum *any* e-mail including your own.

Much more loosely, wouldn't it be easier/nicer to publish the actual dissertation by uploading it to a web hosting service, blog, etc. and post the web address to it?


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: SSD Forensics

Post Posted: Mon Nov 19, 2012 8:06 am

No.

Thanks  

gmlw0908
Member
 
 
  

Re: SSD Forensics

Post Posted: Tue Nov 20, 2012 1:55 am

- Belkasoft
- trewmte
Questions about reliabilty of SSDs have been discussed recently in two articles:
Why SSD Drives Destroy Court Evidence, and What Can Be Done About It: Part 1
By Yuri Gubanov , Oleg Afonin Article Posted: September 26, 2012
www.dfinews.com/articl...-it-part-1
www.dfinews.com/articl...-it-part-2

I happen to be one of the authors of the article referenced below. It's also available here on FF articles.forensicfocus...-about-it/

While not being a scientific research in a fully scientific view, this is still a pretty good snapshot of the state-of-the-art in SSD forencics by Sept. 2012. As far as I know, little changed since then. 500GB SSD's have been introduced, some Samsung drives broke previous price-per-gigabyte records, but that was about it.

SSD forensics remains being hit-or-miss. With SSD's, we're well into probabilistic forensics territory. TRIM may or may not work depending on how the drive was connected, which operating system, what file system, and what exactly was done to the data being destroyed. Crypto containers stored on SSD volumes are yet another matter and are also hit-or-miss, as some manufacturers enable garbage collection within their containers (normally with an option that's disabled by default) and some don't.

In a word, if a fairly modern SSD was used in a Windows 7 PC, connected internally via ATA, formatted with NTFS, no crypto containers, and some data was deleted, then probably that data is now gone. If any one of these conditions is not satisfied (e.g. Vista, or USB connection, or formatted with FAT, or data was stored within a crypto container, or the disk was corrupted - in which case the TRIM command is not being issued), then there are good chances that even deleted data can be restored with carving.

Otherwise, you'll only get whatever files are available (as in "not deleted").


I found both of your (Yuri, Oleg) contributions in this area very useful. Good article, well done.
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
  

Re: SSD Forensics

Post Posted: Tue Nov 20, 2012 5:14 am

- jaclaz

Much more loosely, wouldn't it be easier/nicer to publish the actual dissertation by uploading it to a web hosting service, blog, etc. and post the web address to it?

- gmlw0908
No.


Oh jaclaz, you so crazy with your request to allow the material to be viewed and critically appraised by everyone.

Rolling Eyes  

Chris_Ed
Senior Member
 
 
  

Re: SSD Forensics

Post Posted: Tue Nov 20, 2012 6:10 am

C'mon guys, gmlw0908 helpfully suggested a potentially useful source of information. Whether or not she's happy to post an email address publicly or share the paper more broadly is really up to her - I don't see any need for these responses. If we genuinely want to encourage students to share their research, this isn't the way to do it.

Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Twitter: twitter.com/ForensicFocus
Facebook: www.facebook.com/forensicfocus
Google+: www.google.com/+ForensicFocus
LinkedIn: www.linkedin.com/in/jamiemorris 

jamie
Site Admin
 
 
  

Re: SSD Forensics

Post Posted: Tue Nov 20, 2012 6:17 am

Thank you for you comment Jamie.

Many people helped me on this website during my studies so I return the same favour.

Gabrielle.  

gmlw0908
Member
 
 
  

Re: SSD Forensics

Post Posted: Tue Nov 20, 2012 7:20 am

Well I have emailed Gabrielle for a copy of the dissertation and awaiting a response. I would prefer to read the research irrespective of where it is available.
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 6 of 7
Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next