Issues with: Forensic Acquisition Of Solid State Drives

Is it possible, that a power management configuration (BIOS or OS level) interfered with your test? The drive won't perform a garbage collection when under read stress or powered down soon afterwards.

It is a possibility, but it raises another question… How can 4 different computers, for the period of 30 days, generate the same hash value from an SSD? Four different forensic live CDS were used, plus Ubuntu with auto mount disabled and my fedora workstation with auto mount disabled. I had to plug and unplig the SSD from computer to computer to check the integrity… And the integrity was consistent.

I don't know what else to say.

How can 4 different computers, for the period of 30 days, generate the same hash value from an SSD? Four different forensic live CDS were used, plus Ubuntu with auto mount disabled and my fedora workstation with auto mount disabled. I had to plug and unplig the SSD from computer to computer to check the integrity… And the integrity was consistent.

This is not a question, it is a state of fact, and what I would personal consider "normality", I don't think anyone is doubting this part, as I see it you daily used a "proper procedure" to re-hash (over and over) the same devices/data and the resulting hashes, I may say unsurprisingly, were always the same.

This proved that using a T35es on various computers running different Linux distro's (all with automount disabled) never altered the SSD's and that SSD's do not change contents (and thus hashes) by themselves when stored, not powered, in a cabinet[1].

jaclaz

[1] at least not for periods up to 30 days and if powered daily, would add the mathematician wink

A mathematician, a physicist, and an engineer are riding a train through Scotland.

The engineer looks out the window, sees a black sheep, and exclaims, "Hey! They've got black sheep in Scotland!"

The physicist looks out the window and corrects the engineer, "Strictly speaking, all we know is that there's at least one black sheep in Scotland."

The mathematician looks out the window and corrects the physicist, " Strictly speaking, all we know is that is that at least one side of one sheep is black in Scotland."

Jaclaz that was both accurate and funny D

How can 4 different computers, for the period of 30 days, generate the same hash value from an SSD?

Again If an SSD implements the deterministic read after Trim feature, then the hash will likely be the same. An SSD with the non-deterministic Trim or with the filesystem-aware firmware is a different issue.

Again If an SSD implements the deterministic read after Trim feature, then the hash will likely be the same. An SSD with the non-deterministic Trim or with the filesystem-aware firmware is a different issue.

The list of the SSDs used for the experiments is on section 6.4. Hardware…

Web Page Name

are any of the SSDs listed deterministic read after Trim feature,? I honestly don't know, and as a result I will not be able to comment. (

Hi,

very interesting discussion, so , i have one question about the TD3

the drives connected to the TD3 are mounted ? and is there a risk of TRIM activation?

what is the feedback from the ssd? should it be imaged otherwise than with the TD3?

thanks

the drives connected to the TD3 are mounted ? and is there a risk of TRIM activation?

The TD3 mounts the drive, therefore it will cause changes to the drive. At least that is what happened with us.

the drives connected to the TD3 are mounted ? and is there a risk of TRIM activation?

The TD3 mounts the drive, therefore it will cause changes to the drive. At least that is what happened with us.

But was a TD3 actually used in the experiment?

jaclaz

Yes, a TD3 was used in the experiments.

It was removed from the article because it was a failed experiment.

We did not have a chance to run enough experiments with the TD3

Questions related to the article should be discussed in the article's comments.

Questions related to the article should be either discussed in the article's comments.

… or here.

jaclaz