Forensics and Anti-Forensics of a NAND Flash Memory: From a Copy-Back Program Perspective

Ahn, Na-Young; Lee, Dong Hoon

doi:10.1109/access.2021.3052353

Cited by 9 publications

(14 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Digital forensics is a generic term for forensic techniques used for investigation by analyzing digital evidence. Recently, in connection with IoT devices, there is abundant research on digital forensics for NAND flash memory [15][16][17][18][19][20][21], which poses new questions about what the target of digital forensics in NAND flash memory is. Before defining this, though, it is first necessary to digitally grasp the concept of what original data is.…”

Section: Original Data In Nand Flash Memorymentioning

confidence: 99%

See 1 more Smart Citation

Security of IoT Device: Perspective Forensic/Anti-Forensic Issues on Invalid Area of NAND Flash Memory

Ahn

Lee

2022

IEEE Access

Self Cite

View full text Add to dashboard Cite

NAND flash memory-based IoT device can potentially still leave behind original personal data in an invalid area even if the data has been deleted. In this paper, we raise the forensic issue of original data remaining in unmanaged blocks caused by NAND flash memory and introduce methods for secure deletion of such data in the invalid area. We also propose a verification technique for secure deletion that is performed based on cell count information, which refers to the difference in bits between personal data and data stored in the block. The pass/fail of the verification technique according to the cell count information is determined in consideration of error correction capabilities. With the forensic issue of de-identification being a vital theme in the big data industry, the threat of serious privacy breaches coupled with our proposal to prevent these attacks will prove to be critical technological necessities in the future.

show abstract

Section: Original Data In Nand Flash Memorymentioning

confidence: 99%

“…For this reason, NAND flash memory performs various internal operations to extend life span and improve performance. Related to these internal actions, studies on the dangers of forensics have recently been raised [15][16][17][18][19][20][21].…”

Section: Introductionmentioning

confidence: 99%

Security of IoT Device: Perspective Forensic/Anti-Forensic Issues on Invalid Area of NAND Flash Memory

Ahn

Lee

2022

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…Basically, NAND flash memory causes a significant amount of garbage collection because the program/read unit and the erase unit are different. Such garbage collection inevitably follows the propagation of the original data inside NAND flash memory [19]. In other words, if the original data exists in the validated block, there is a very high possibility that the original data is left as is in the plurality of invalidated blocks.…”

Section: B Secure Garbage Collectionmentioning

confidence: 99%

“…From a privacy point of view, garbage collection should be performed to prevent the spread of original data. Ahn was the first to propose this discussion and introduced a secure garbage collection method that prevents the spread of original data via a novel secure copy-back program [8,9,19].…”

Section: B Secure Garbage Collectionmentioning

confidence: 99%

Forensic Issues and Techniques to Improve Security in SSD With Flex Capacity Feature

Ahn¹,

Lee

2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

Over-provisioning technology is typically introduced as a means to improve the performance of storage systems, such as databases. The over-provisioning area is both hidden and difficult for normal users to access. This paper focuses on attack models for such hidden areas. Malicious hackers use advanced over-provisioning techniques that vary capacity according to workload, and as such, our focus is on attack models that use variable over-provisioning technology. According to these attack models, it is possible to scan for invalid blocks containing original data or malware code that is hidden in the over-provisioning area. In this paper, we outline the different forensic processes performed for each memory cell type of the overprovisioning area and disclose security enhancement techniques that increase immunity to these attack models. This leads to a discussion of forensic possibilities and countermeasures for SSDs that can change the over-provisioning area. We also present information-hiding attacks and information-exposing attacks on the invalidation area of the SSD. Our research provides a good foundation upon which the performance and security of SSD-based databases can be further improved.

show abstract

“…In [10], [11], the authors discuss how to adapt acquisition and analysis techniques to recover accurate and relevant data from flash memory chips; however, this is under the implicit assumption that they are not damaged. In [12], the authors explain that due to their block-based structure, flash memories are becoming forensics targets but they mainly propose an anti-forensic technique. Although present in most IoT devices, SD cards are rarely considered in recent surveys dealing with IoT forensics [13]- [15], further increasing the potential value of our contribution of a systematic diagnostic forensic protocol for damaged SD cards.…”

Section: Introductionmentioning

confidence: 99%

New Diagnostic Forensic Protocol for Damaged Secure Digital Memory Cards

et al. 2022

View full text Add to dashboard Cite

Over the past twenty years, Secure Digital memory cards have become the most popular digital storage media. Therefore, law enforcement agencies need to develop forensic techniques to enable recovery of data, especially from cards severely damaged by accidents, air crashes, terrorist attacks or deliberate attempts by criminals to destroy evidence. The paper discusses the non-invasive and invasive diagnostics available to legal forensic experts, with descriptions of the necessary equipment, including binocular microscopes, X-Ray equipment, scanning acoustic microscopes, chemical benches, and, for the first time, infrared cameras. All of these techniques can be used to methodically determine the best treatment in order to repair damaged storage media and extract data from them. The main contributions of the paper include the development of an innovative systematic forensic protocol for diagnostics on damaged cards, which involves a simple decision-making diagram. Finally, a concrete case study is presented using the new forensic decision diagram-based protocol and the panel of techniques available to diagnose a card damage.

show abstract

Forensics and Anti-Forensics of a NAND Flash Memory: From a Copy-Back Program Perspective

Cited by 9 publications

References 31 publications

Security of IoT Device: Perspective Forensic/Anti-Forensic Issues on Invalid Area of NAND Flash Memory

Security of IoT Device: Perspective Forensic/Anti-Forensic Issues on Invalid Area of NAND Flash Memory

Forensic Issues and Techniques to Improve Security in SSD With Flex Capacity Feature

New Diagnostic Forensic Protocol for Damaged Secure Digital Memory Cards

Contact Info

Product

Resources

About