Hey Folks,
We haven't had any SSD come through so far and I'm wondering if any other labs have had much experience with them. I've watched and would recommend the 5 part video entitled "why solid state drives will ruin forensics." I think the title is captivating rather than accurate but I found the videos informative nonetheless.
The speaker goes over some important fundamental differences of SSD and the problems these may cause. Much of the supposed difficulty concerned the fact that in order to work on cases involving data recovery, examiners would need a new skill set similar to electrical engineers in addition to the mechanical skills currently required for working with HDD. This got me to further wondering how often forensics labs actually encounter cases which require substantial recovery prior to the actual forensics. The speaker runs a combination forensics/recovery business and it seems to me that SSD may wedge these two related industries further apart more so than make forensics itself much more difficult. Is it not possible that the true digital design of SSD could make forensics easier in some ways once the proper tools are developed? Hiccups are to be expected when replacing a 50-year-old technology. Interested to hear some opinions on this.
Data Forensics & Security Consultant
Digital forensics is not always depending on data recovery or relying on deleted files. It definitely makes things more complicated, but the same applies to disk wiping utilities, which haven’t ruined digital forensics )
As I see it, a problem might be the wear leveling features of SSD drives, check this other thread
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=3542
Unless special procedures are used, hashing (and thus verification) may turn out "pointless", creating something "unrepeatable" and thus unusable in forensics as evidence….or however making it appear so.
jaclaz