Thanks for all the info guys, i've had a little look into this topic a bit more and it seems there are quite a lot of existing issues. One possibility i discussed with a colleague of mine, is to bypass the hardware controller chip within the SSD by identifying which pins are responsible for writing data and disabling them or disconnect them, then attaching a hardware write blocker in between the controller and NAND chips………… but still yet to investigate further. still also need to look at some of these links on here, will post more developments soon……………………..
Whilst I'm not too sure on the success of the possibility you mentioned samray, have you considered the ethical implications of your proposed method?
In reality you want to do everything possible to get the data, but theoretically you shouldn't be doing anything that damages the data or the hardware that the data is housed in. By pulling out the pins responsible for writing data you would be doing just that.
Remember your ACPO principles!
Hope that gives you and additional angle to think about.
I am not LE so not that familiar with ACPO.
However, by plugging a drive in it almost certainly means that any deleted data will be purged and lost for good. If there is a suspicion that the delete key has just been pressed, then the only safe solution is a 'chip off' process.
If the drive has been idle for maybe 30 mins, then everything has probably been purged anyway.
I think a complete chip off is probably much safer than trying to lift pins or tracks, or using write blockers in the middle of the SSD. Once the chip is out, you have a controlled environment in which to read and process the data
Whilst I'm not too sure on the success of the possibility you mentioned samray, have you considered the ethical implications of your proposed method?
In reality you want to do everything possible to get the data, but theoretically you shouldn't be doing anything that damages the data or the hardware that the data is housed in. By pulling out the pins responsible for writing data you would be doing just that.
Remember your ACPO principles!
Hope that gives you and additional angle to think about.
There shouldn't be any issues regarding the alteration of the ssd controller after all the controller does not store any of the data, and justification of what we are doing and mentioning the fact the the data is not being touched as we are not interfering with any NAND chips prevents us from infringing on principle 1 and 2 of ACPO. I think you may need to read over the principles again. I wouldn't be too sure on the success of such a task either, but I think its something we should consider…
I am not LE so not that familiar with ACPO.
However, by plugging a drive in it almost certainly means that any deleted data will be purged and lost for good. If there is a suspicion that the delete key has just been pressed, then the only safe solution is a 'chip off' process.
If the drive has been idle for maybe 30 mins, then everything has probably been purged anyway.
I think a complete chip off is probably much safer than trying to lift pins or tracks, or using write blockers in the middle of the SSD. Once the chip is out, you have a controlled environment in which to read and process the data
Could be a possible solution, however I would be concerned with removing the NAND chips from the device in accordance with the first two principles of ACPO which state that under no circumstances should data be changed, and if original data is to be accessed then you must justify the relevance and implications of your actions, whilst it sounds like a workable solution and im sure it would be im not sure if you would be able to work around that without infringing on those two principles.
I believe a great deal more ground work needs to be produced into the operation and architecture of the SSD controllers used before we can begin to understand how to appropriately tackle this issue..
"chip off" maybe the safest unless the ICs get toasted in the removal process, but it is not the easiest as there are a lot of technical information need to be ready before making sense of the data on the ICs.
Well you saying that, I found this the other day, looks quite interesting…..
http//