Deconstruct and Preserve (DaP): A Method for the Preservation of Digital Evidence on Solid State Drives (SSD)

Abstract

Abstract. Imaging SSDs is problematic due to TRIM commands and garbage collectors that make the SSD behave inconsistently over time. It is this inconsistency that can cause a difference between images taken of the SSD. These differences result in unmatched hash number generation and would normally be attributed to contamination or spoliation of digital evidence. DaP is a proposed method that ensures all images taken of the SSD are consistent and removes the volatility normally associated with these devices. DaP is not focused with the recoverability of deleted data, however DaP does stabilise the device to prevent unintentional contamination due to garbage collection. Experiments show that the DaP method works on a range of devices and consistently produces the hash-identical images. The conclusions are to consider DaP as a new Standard Operating Procedure (SOP) when imaging SSDs.

Solid state drive forensics analysis—Challenges and recommendations

“…It is not only the nondeterministic TRIM but fault in SSD controller or bugs in driver software can also create some difficult scenario. 18…”