±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 3
New Yesterday: 7
Overall: 26818
Visitors: 44

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

SSD Forensics

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3, 4, 5, 6, 7  Next 
  

SSD Forensics

Post Posted: Thu Oct 25, 2012 11:18 am

Hi!

I haven't done any new forensics training in about two years.

Can anyone give me some training resources / tips on what to do with SSDs?

I am imaging one right now, and not sure what to expect. Can anyone shine some light on the matter?

Am I likely to recover any deleted files? Will the auto-wearleveling feature mess up my evidence?  

scottyxx
Member
 
 
  

Re: SSD Forensics

Post Posted: Thu Oct 25, 2012 3:09 pm

A very good read - www.jdfsl.org/subscrip...3-Bell.pdf  

cgpa1
Member
 
 
  

Re: SSD Forensics

Post Posted: Thu Oct 25, 2012 8:27 pm

- cgpa1


I'm sorry but you are kidding aren't you?

Defamation laws prevent me from really saying anything here so I won't go into detail, but I will say I have numerous professional experiences of one of the co-authors "forensic skills" so I have a special place where I might use that paper.

One of the sad things about society is that if you work at a university all of a sudden people believe everything you say Wink

My experience aside that paper was mashed together nearly 3 years ago and the technology has changed significantly in that time period. So even if his research and testing was by some miracle actually sound, it's completely irrelevant today.  

Adam10541
Senior Member
 
 
  

Re: SSD Forensics

Post Posted: Fri Oct 26, 2012 12:58 am

- scottyxx
Hi!
Can anyone give me some training resources / tips on what to do with SSDs?

I am imaging one right now, and not sure what to expect. Can anyone shine some light on the matter?
?


It may have been best to ask this before you started imaging the drive as 'garbage collection', which runs independently of the operating system, will begin wiping unallocated clusters soon after powering on.
_________________
Forensic Control
twitter.com/ForensicControl 

Jonathan
Senior Member
 
 
  

Re: SSD Forensics

Post Posted: Fri Oct 26, 2012 1:14 am

- scottyxx
Hi!

I haven't done any new forensics training in about two years.

Can anyone give me some training resources / tips on what to do with SSDs?

I am imaging one right now, and not sure what to expect. Can anyone shine some light on the matter?

Am I likely to recover any deleted files? Will the auto-wearleveling feature mess up my evidence?


It behaves exactly like any other HDD or USB storage device. You are very likely to recover deleted files Smile  

Chris_Ed
Senior Member
 
 
  

Re: SSD Forensics

Post Posted: Fri Oct 26, 2012 4:16 am

The nice thing about SSD's, Flash...etc, it will store more deleted content than a platter. UH???? What???? Shocked Due to the limited writes to these devices, manufactures make it so the computer writes to the entire drive before reallocating the un-allocated space to new data. As stated by "Chris_Ed" I second his statement.  

mrpumba
Senior Member
 
 
  

Re: SSD Forensics

Post Posted: Fri Oct 26, 2012 7:26 am

- mrpumba
The nice thing about SSD's, Flash...etc, it will store more deleted content than a platter. UH???? What???? Shocked Due to the limited writes to these devices, manufactures make it so the computer writes to the entire drive before reallocating the un-allocated space to new data. As stated by "Chris_Ed" I second his statement.


It depends totally on the drives implementation. They use TRIM and garbage collection to speed up any future writing to the drives. If you write to the whole drive and then start overwriting it then it will be incredibly slow as with solid state drives you have effectively two write cycles as each block needs to be zeroed before it can be written to, instead of simply overwriting blocks like on a hdd. Generally TRIM and Garbage collection are enabled for the purpose of not slowing the drive down, after all who wants a slow drive?

I found with my old drive the whole drive was zeroed in less than a minute. dig-forensics.blogspot...-trim.html  

agolding
Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 7
Go to page 1, 2, 3, 4, 5, 6, 7  Next