Data Recovery on SS...
 
Notifications
Clear all

Data Recovery on SSD

2 Posts
2 Users
0 Likes
971 Views
Northwind
(@northwind)
Posts: 33
Eminent Member
Topic starter
 

Why Data Recovery on SSD Is More Difficult than That on HDD?

 
Posted : 14/04/2018 10:40 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Why Data Recovery on SSD Is More Difficult than That on HDD?

Is it?

Talking of functional devices, there is not that much difference AFAICT.

What may make a BIG difference is TRIM and garbage collection, but the difference is not much about data recovery (which procedures remains the same), it revolves more about (deleted) data persistence and (possibly) increased fragmentation.

If you prefer on a normal hard disk, with a couple (manual) interventions (deleted) data can be actually deleted or partially shredded/corrupted, all that is needed is a defrag and the creation/saving of one or more "huge" files, while on SSD's the OS (or SSD controller) built-in provisions have almost the same effects in an automatic way that is transparent to the users.

Additionally DRAT and/or DZAT may make released blocks appear as zero or *whatever* independently from the actual block contents, unless chip-off extraction is used, see
https://belkasoft.com/download/info/SSD Forensics 2014.pdf
BTW, chip-off reading (and decoding data from "raw" chip contents dumps) may be not "easy-peasy", still it seems like way easier and feasible than attempting to recover data directly from a hard disk plate.

And - to be fair - there is over provisioning that may actually increase the amount of retrievable data (still in the case of chip-off)

jaclaz

 
Posted : 14/04/2018 11:29 am
Share: