SSD Forensic: Evidence Generation and Forensic Research on Solid State Drives Using Trim Analysis

Abstract

Traditional hard drives consisting of spinning magnetic media platters are becoming things of the past as with the emergence of the latest digital technologies and electronic equipment, the demand for faster, lighter, and more reliable alternate storage solutions is imperative. To attain these requirements, flash storage technologies like Solid State Drive (SSD) has overtaken traditional hard disk drives. In a forensic analysis of flash storage devices, forensic investigators are facing severe challenges for the reason that the sovereign behavior of solidstate storage media does not look favorable compared to traditional storage media devices. Wear Leveling, a fundamental mechanism in Solid State Drive (SSD), plays a severe challenge that most often destroys forensic evidence in many cases. It makes it complicated for forensic investigators to recover the necessary evidence.Persistence of deleted data in flash storage media depends on various factors like the Garbage Collection process, TRIM command, flash media type, manufacturer, capacity, file system, type of file saved, and the Operating System, etc. In view of this, extensive experiments conducted to identify the probability of data recovery and carving. Analyzed effects of Wear Leveling and Garbage Collection processes in Solid State Drive (SSD) of different manufacturers, having the same storage capacities and with a different type of files utilized. In conclusion, experimental findings established the fact that Wear Leveling in solid-state media can obfuscate digital evidence, and a conventional assumption regarding the behavior of storage media is no more valid. Moreover, data persistency also depends on the manufacturers, time-lapse of forensic analysis after data deletion, type of files, and size of files stored in Solid State Drives (SSD).

Implementation of Live Forensic Method on Fusion Hard Disk Drive (HDD) and Solid State Drive (SSD) RAID 0 Configuration TRIM Features

“…According to the digital forensic perspective, the contradiction of using an SSD with its TRIM feature [16] has a negative effect on forensic analysis, especially on data recovery regarding the integrity value of the authenticity of data that has been lost or deleted, which means that it is necessary to carry out live forensic techniques in carrying out HDD and SSD fusion analysis. RAID 0 configuration TRIM function which refers to the SNI 27037:2014 standard uses forensic tools Sleuthkit Autopsy and Tesdisk in digital forensic investigations used for data recovery.…”

“…It is a stage in preparing hardware and software specifications used in this research such as fusion HDD and SSD RAID 0 configuration and implementation of Non-Vollatille memory analysis used as the object of research [16]. While the forensic tools used are FTK Imager Portable and Testdisk Recovery.…”

An Investigation on File Carving Tool Methodologies Using Scenario Based Image Creation

“…Foremost was also used to develop a carving tool called Scalpel, and Scalpel currently shares the code with Foremost but uses an optimized method to reduce unnecessary memory-to-memory copy and disk I/O, and has relatively good performance. However, since Scalpel has more diverse header/footer signatures and data structures for file carving than Foremost, which is set by default, the number of files that can be carved increases unnecessarily (7) . There are limitations to the experimental environment in the study.…”