±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36290
New Yesterday: 2 Visitors: 163

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

SSD Forensics

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4, 5, 6, 7  Next 
  

trewmte
Senior Member
 

Re: SSD Forensics

Post Posted: Nov 01, 12 09:43

Questions about reliabilty of SSDs have been discussed recently in two articles:


Why SSD Drives Destroy Court Evidence, and What Can Be Done About It: Part 1
By Yuri Gubanov , Oleg Afonin Article Posted: September 26, 2012

www.dfinews.com/articl...-it-part-1



Why SSD Drives Destroy Court Evidence, and What Can Be Done About It: Part 2
By Yuri Gubanov , Oleg Afonin Article Posted: October 03, 2012

www.dfinews.com/articl...-it-part-2
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

Chris_Ed
Senior Member
 

Re: SSD Forensics

Post Posted: Nov 01, 12 16:33

But that's not true of all SSDs. The one I use in one of my forensic workstations, for example, retains deleted data.  
 
  

mscotgrove
Senior Member
 

Re: SSD Forensics

Post Posted: Nov 01, 12 18:01

Chris_Ed

What are your forensic work stations (XP, Windows 7??)

How are the drives connected, directly or via USB or eSata?
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

PaulSanderson
Senior Member
 

Re: SSD Forensics

Post Posted: Nov 01, 12 19:20

I argued that this needed to be implemented at a device driver level many years ago on this forum and that it was daft to assume that the drive understood the operating system - that discussion got quite heated so I stopped contributing to it.

Anyway

to see if trim is enabled in an administrator cmd box type

fsutil behavior query disabledeletenotify

to enable trim

fsutil behavior set disabledeletenotify 0

to disable

fsutil behavior set disabledeletenotify 1
_________________
Paul Sanderson
SQLite Forensics Book
www.amazon.com/SQLite-...entries*=0

Forensic Toolkit for SQLite
sandersonforensics.com...for-SQLite 
 
  

jaclaz
Senior Member
 

Re: SSD Forensics

Post Posted: Nov 01, 12 19:29

- Chris_Ed
But that's not true of all SSDs.


www.forensicfocus.com/...0/#6562810
- jaclaz

Right now it seems like everything (and the contrary of everything) is possible. Shocked


www.forensicfocus.com/...3/#6562853
- ecophobia
I haven't been following this forum for some time now, been too busy with other things. When I finally got back, I was surprised to see SSD and Trim are still being discussed here.

As a few people (good to see them hanging around) already correctly pointed out here, everything and anything is possible with SSD technology.



Generalizing is (as often is) misleading.

Layman's example:

Most land vehicles have wheels.
Most wheeled vehicles have brakes.
Most brakes are commanded by hydraulics.

Hence to cause an accident to a land vehicle you can (mostly) cut it's hydraulic brake lines . Shocked

Now, try cutting the hydraulic lines of a wheelbarrow. Rolling Eyes

Each SSD make/model may behave differently and even the same SSD make/model may behave differently in different setups/environments.


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

ecophobia
Senior Member
 

Re: SSD Forensics

Post Posted: Nov 03, 12 22:38

I completely agree on generalization.
One might see the different meaning of my post.

Aesop

Laughing  
 
  

Jonathan
Senior Member
 

Re: SSD Forensics

Post Posted: Nov 04, 12 16:54

- mrpumba
- Jonathan
- mrpumba
Watch this video in its entirety....

youtu.be/vLoYduckmuo


I don't have 45 minutes. Is there a precis available?


@ Scottyxx - Can anyone give me some training resources / tips on what to do with SSDs?

I am imaging one right now, and not sure what to expect. Can anyone shine some light on the matter?

Am I likely to recover any deleted files? Will the auto-wearleveling feature mess up my evidence?


Isn't everything we do in CF based on time consumption??


Yes; but I need to decide how to spend that time. As I'm neither aware of you or the video maker I think it's reasonable enough to ask for a precis before I dive in!
_________________
Forensic Control
twitter.com/ForensicControl
St Bride Foundation, 14 Bride Lane, London, EC4Y 8EQ 
 

Page 4 of 7
Page Previous  1, 2, 3, 4, 5, 6, 7  Next