Hi!

I haven't done any new forensics training in about two years.

Can anyone give me some training resources / tips on what to do with SSDs?

I am imaging one right now, and not sure what to expect. Can anyone shine some light on the matter?

Am I likely to recover any deleted files? Will the auto-wearleveling feature mess up my evidence?  

A very good read - www.jdfsl.org/subscrip...3-Bell.pdf  

- cgpa1

A very good read - www.jdfsl.org/subscrip...3-Bell.pdf

I'm sorry but you are kidding aren't you?

Defamation laws prevent me from really saying anything here so I won't go into detail, but I will say I have numerous professional experiences of one of the co-authors "forensic skills" so I have a special place where I might use that paper.

One of the sad things about society is that if you work at a university all of a sudden people believe everything you say

My experience aside that paper was mashed together nearly 3 years ago and the technology has changed significantly in that time period. So even if his research and testing was by some miracle actually sound, it's completely irrelevant today.  

- scottyxx

Hi!
Can anyone give me some training resources / tips on what to do with SSDs?

I am imaging one right now, and not sure what to expect. Can anyone shine some light on the matter?
?

It may have been best to ask this before you started imaging the drive as 'garbage collection', which runs independently of the operating system, will begin wiping unallocated clusters soon after powering on.
_________________
Forensic Control
twitter.com/WeFindData 

- scottyxx

Hi!

I haven't done any new forensics training in about two years.

Can anyone give me some training resources / tips on what to do with SSDs?

I am imaging one right now, and not sure what to expect. Can anyone shine some light on the matter?

Am I likely to recover any deleted files? Will the auto-wearleveling feature mess up my evidence?

It behaves exactly like any other HDD or USB storage device. You are very likely to recover deleted files  

The nice thing about SSD's, Flash...etc, it will store more deleted content than a platter. UH???? What???? Due to the limited writes to these devices, manufactures make it so the computer writes to the entire drive before reallocating the un-allocated space to new data. As stated by "Chris_Ed" I second his statement.  

- mrpumba

The nice thing about SSD's, Flash...etc, it will store more deleted content than a platter. UH???? What???? Due to the limited writes to these devices, manufactures make it so the computer writes to the entire drive before reallocating the un-allocated space to new data. As stated by "Chris_Ed" I second his statement.

It depends totally on the drives implementation. They use TRIM and garbage collection to speed up any future writing to the drives. If you write to the whole drive and then start overwriting it then it will be incredibly slow as with solid state drives you have effectively two write cycles as each block needs to be zeroed before it can be written to, instead of simply overwriting blocks like on a hdd. Generally TRIM and Garbage collection are enabled for the purpose of not slowing the drive down, after all who wants a slow drive?

I found with my old drive the whole drive was zeroed in less than a minute. dig-forensics.blogspot...-trim.html