Why SSD is a challenge for forensic analysis?

Why SSD is a challenge for forensic analysis?

There is a feature called wear leveling in SSDs which can be a challenge for digital investigators. The process of wear leveling can internally move the data among different area of flash memory in the SSD which changes the hash values. This change will make the acquired evidence unfit for an investigation.

What is SSD forensic data corrosion?

As the process of erasing previously occupied blocks tends to be much slower compared to reading and writing, SSD drives full of “dirty” blocks will require significant time to write even a single block of data as no empty (erased) blocks exist. Forensic researchers named this process as “self-corrosion” [7] [12].

What problems do SSD’s provide to forensics?

The problem this presents in SSD forensic analysis is that the data is extremely fragmented. To make matters worse, there is no storage pattern; data is basically stored to the block that has the fewest writes on it. Right now, SSD forensic analysis remains a huge challenge for examiners.

Does SSD have slack space?

In the word of SSD, the term “slack space” receives a new meaning. Rather than being a matter of file and cluster size alignment, “slack space” in SSD drives deals with the different sizes of minimum writeable and minimum erasable blocks on a physical level.

What is TRIM command SSD?

The Trim command tells the SSD that specific areas contain data that is no longer in use. Instead, the area of the SSD that contains the data is marked as no longer used. The Trim command tells the drive that the data can be removed. The next time the computer is idle, Active Garbage Collection will delete the data.

How do I know if Windows Automount is enabled?

1. To determine if automatic mounting of new volumes is enabled, use the following commands: Copy C:\> diskpart DISKPART> automount Automatic mounting of new volumes disabled.
2. To enable automounting: Enter the following commands at a command prompt:

Why can you undelete files in Windows 7?

If you have kept the system protection on where deleted files are saved and you also made a restore point, then you can retrieve deleted files in Windows 7 by restoring the previous version.

Is it possible to forensically acquire data from a SSD?

Contribution This work contributes to the field of digital forensic investigation by proving that it is possible to forensically acquire data from a Solid State Drive (SSD)*, while preserving the volatile data that would otherwise, using current data acquisition methods, be lost.

How to check the integrity of a SSD?

Connect the SSD to the forensic workstation using writeblocker. Verify the integrity of the device, using the hashing algorithm SHA-1, and take note of the generated hash value. Create a bit-stream copy. Verify the integrity of the bit-stream copy against the original hash value.

Can a solid state drive be used for forensics?

The field of computer forensics has been in need of a method to perform forensic data acquisition from Solid State Drives for a long time.

How to make the forensic image of the hard drive?

Most often, when creating forensic copies of hard drives, an Encase file is used. In this case, the acquired data from the source drive is compressed (for example, in the case of forensic accounting, the file size – forensic image of the hard drive of the accounting computer can be 9 times smaller than the size of the source drive).