Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery?

Abstract

Digital evidence is increasingly relied upon in computer forensic examinations and legal proceedings in the modern courtroom. The primary storage technology used for digital information has remained constant over the last two decades, in the form of the magnetic disc. Consequently, investigative, forensic, and judicial procedures are well-established for magnetic disc storage devices (Carrier, 2005). However, a paradigm shift has taken place in technology storage and complex, transistor-based devices for primary storage are now increasingly common. Most people are aware of the transition from portable magnetic floppy discs to portable USB transistor flash devices, yet the transition from magnetic hard drives to solid-state drives inside modern computers has so far attracted very little attention from the research community.Here we show that it is imprudent and potentially reckless to rely on existing evidence collection processes and procedures, and we demonstrate that conventional assumptions about the behaviour of storage media are no longer valid. In particular, we demonstrate that modern storage devices can operate under their own volition in the absence of computer instructions. Such operations are highly destructive of traditionally recoverable data. This can contaminate evidence; can obfuscate and make validation of digital evidence reports difficult; can complicate the process of live and dead analysis recovery; and can complicate and frustrate the post recovery forensic analysis.Our experimental findings demonstrate that solid-state drives (SSDs) have the capacity to destroy evidence catastrophically under their own volition, in the absence of specific instructions to do so from a computer.

Deconstruct and Preserve (DaP): A Method for the Preservation of Digital Evidence on Solid State Drives (SSD)

“…Market share of SSD is increasing, along with that is knowledge by defendants that there are methods to wipe the information with 0% chance of no data recovery. Research [3,5,8] has backed this fact up and shows under certain circumstances how this can be achieved. Under e-Discovery requests, such violations are covered by the wilful destruction of evidence under the guise of a preservation order [9], however a preservation order does not exist at crime scenes.…”

“…This, along with wear-levelling [3], means that the equivalent of sectors have to be reset to zeroes, before being written to. This creates all kinds of problems that is the responsibility of the controller.…”

“…The following list explains the process of the experiment, that is not too different from [3]. The minor differences are: i) Python code, instead of batch code; ii) the replacement of 'EVIDENCE' with '12345678'; and iii) the size of the files.…”

“…Such "covert" changes yield inconsistencies between third party images. It is becoming common knowledge among practitioners that the practicality of producing two or more exact byte-for-byte images (hash-identical) from SSDs for all parties is becoming problematic [3]. Generally, the probability of producing hash-identical images is diminished as the time between seizure and data acquisition stage is increased.…”

Filologia i proces pisania cyfrowego – metody i wyzwania

“…Wyodrębniona do postaci statycznej fi zyczna struktura nośnika danych jest uważana za właściwe źródło dla informatyki śledczej, ponieważ udowodniono, że fi zyczny cień magnetyczny przeszłych czynności zapisu na dyskach twardych nie może być wykorzystywany w praktyce do odzyskiwania nadpisanych plików lub ich fragmentów 32 . Praktyczne konsekwencje wprowadzenia dysków półprzewodnikowych (SSD) dla obrazowania typu kryminalistycznego i odzyskiwania danych przez organy ścigania oraz, co za tym idzie, dla długotrwałej archiwizacji i analizy fi lologicznej są obecnie przedmiotem badań kryminalistycznych 33 . Filologia i proces pisania cyfrowego -metody i wyzwania Dokument cyfrowy i ślad cyfrowy nie stanowią same w sobie wystarczającego dowodu, gdyż należy je oceniać na tle pierwotnego kontekstu systemowego, czyli konkretnego historycznego zestawienia sprzętu, systemu operacyjnego, aplikacji i danych użytkowania.…”