Issues with: Forensic Acquisition Of Solid State Drives

AmNe5iA · 2018-03-14T17:54:47Z

Recently Forensic Focus published the following article.Forensic Acquisition of Solid State Drives with Open Source Tools/Much of this article flew in the face of what I understood as the issues regarding the TRIM command and garbage collection on SSD.I understand the main issue as being that if files are deleted, the OS send the TRIM command to the SSD which can start the whole garbage collection mechanism. In the same way you can avoid files being actively deleted by pulling power to the drive, you can do the same with an SSD that has received the TRIM command but as soon as you power the SSD on again the garbage collection resumes, regardless of whether or not it is connected to a write blocker. You effectively get stuck in a situation where you believe the contents of the deleted files still remain on the SSD but the very process of plugging it in to image it, results in the contents of those files being purged. I assumed, when I opened this article that this would be the issue being dealt with. It is not.The author seems to believe that the TRIM command will be sent/resent only when mounted. As far as i am aware simply mounting a filesystem on an SSD would not start the process of sending TRIM commands. In addition I was also under the impression that TRIM command,s could only be sent over certain connections. For example TRIM command can be sent via SATA connection but not by a USB connection.As far as I am aware to resend TRIM commands you'd have to mount the filesystem (whilst enabling the 'discard' option) AND THEN also run a command like fstrimIs that right?And, if you had mounted the filesystem over a USB connection, the TRIM command wouldn't even reach the SSD.Is that right?In addition, it is my understanding that any ongoing garbage collection would not be prevented by not mounting the filesystem.I'm not really sure what he has proved or achieved in this paper if my assumptions/beliefs are correct.Also, in this paper he states that certain cables prevent reliably hashing the same SSDs (Section 7.3.1). They all prove reliable when they are used to hash a partition but not when hashing a volume. How do you hash a volume? You can hash a patrtion easily enough, 'md5sum /dev/sda1' but how has he hashed the volume? ' md5sum /mnt/sda1'???? I suspect that is the real reason the results are not reliable, not because of any specific cables.Can someone please explain this all to me?