TRIM command for SS...
 
Notifications
Clear all

TRIM command for SSD - problem for forensics analysis?

14 Posts
6 Users
0 Reactions
1,287 Views
(@jonathan)
Prominent Member
Joined: 20 years ago
Posts: 878
 

TRIM appears to be standardised with, as far as I know, all the main SSD manufacturers enabling it on their drives.

OK, so you don't know either.

I've only found a proposed standard for ATA8-ACS2 from december 2007 – which seems long enough ago that I thought it might have been ratified recently. But then it is probably still at the proposal stage of the standardization process.

The standardisation of the TRIM command was not my main point - which was about the availability of deleted data - however as TRIM has already been implemented by Microsoft, in Linux, Intel, OCZ, Corsair and Kingston perhaps standardisation is a moot point from a computer forensics view?


   
ReplyQuote
(@code_slave)
Trusted Member
Joined: 16 years ago
Posts: 61
 

Most SSD are based on Nand-Flash.

The issue with nand-flash storage is that it 'must' be erased before it can be re-used.
This erasure takes time, several ms infact.

So if you erase just before re-using it, you lengthen your write times as seen by the user.

But as most drives spend large amounts of time sitting about, the best time to do 'house keeping' is this idle time.
That way the space is already relased for when you need it.

But since the diskdrive does not 'know' about the file system sturcture, it has to be physically informed exactly WHICH blocks are to be erased, since erasing on a normal hard drive before re-use is not needed, there is no need for this command, other than on drives (SSD) that need this information


   
ReplyQuote
(@memon)
Active Member
Joined: 16 years ago
Posts: 13
Topic starter  

I gave a talk on SSD forensics challanges at Techno Forensics. The slides can be got from http//digital-assembly.com/technology/research/talks/challenges-of-ssd-forensic-analysis.pdf


   
ReplyQuote
(@code_slave)
Trusted Member
Joined: 16 years ago
Posts: 61
 

Hmm,
I have just finished writing my Thesis on a system to solve these and other related Nand-Flash memory problems. I was looking for a reference to use.

I see you picked up the Copy-back caveat , there is a whole can of worms there……

Do you have a formal paper written on this stuff instead of just the slides?

C.


   
ReplyQuote
Page 2 / 2
Share: