TRIM, Wear Levelling and Garbage Collection on Solid State Drives: A Prediction Model for Forensic Investigators

Nisbet, Alastair; Jacob, Rijo

doi:10.1109/trustcom/bigdatase.2019.00063

Cited by 3 publications

(4 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Digital forensics is a generic term for forensic techniques used for investigation by analyzing digital evidence. Recently, in connection with IoT devices, there is abundant research on digital forensics for NAND flash memory [15][16][17][18][19][20][21], which poses new questions about what the target of digital forensics in NAND flash memory is. Before defining this, though, it is first necessary to digitally grasp the concept of what original data is.…”

Section: Original Data In Nand Flash Memorymentioning

confidence: 99%

“…A TRIM operation is performed inside the storage device when the user deletes data [16,33], and it can accurately erase pages in a logically invalidated file. However, since the TRIM operation basically uses a block-erase operation, it weakens the deterioration characteristic of the memory block and is not desirable in terms of management, such as power consumption due to an additional erase operation.…”

Section: B Limitation Of Trim Operationmentioning

confidence: 99%

“…For this reason, NAND flash memory performs various internal operations to extend life span and improve performance. Related to these internal actions, studies on the dangers of forensics have recently been raised [15][16][17][18][19][20][21].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Security of IoT Device: Perspective Forensic/Anti-Forensic Issues on Invalid Area of NAND Flash Memory

Ahn

Lee

2022

IEEE Access

View full text Add to dashboard Cite

NAND flash memory-based IoT device can potentially still leave behind original personal data in an invalid area even if the data has been deleted. In this paper, we raise the forensic issue of original data remaining in unmanaged blocks caused by NAND flash memory and introduce methods for secure deletion of such data in the invalid area. We also propose a verification technique for secure deletion that is performed based on cell count information, which refers to the difference in bits between personal data and data stored in the block. The pass/fail of the verification technique according to the cell count information is determined in consideration of error correction capabilities. With the forensic issue of de-identification being a vital theme in the big data industry, the threat of serious privacy breaches coupled with our proposal to prevent these attacks will prove to be critical technological necessities in the future.

show abstract

Section: Original Data In Nand Flash Memorymentioning

confidence: 99%

Section: B Limitation Of Trim Operationmentioning

confidence: 99%

See 1 more Smart Citation

Security of IoT Device: Perspective Forensic/Anti-Forensic Issues on Invalid Area of NAND Flash Memory

Ahn

Lee

2022

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Traditional magnetic media hard drives are phasing out gradually, and Solid State Drives (SSD) is filling the space of storage needs. Alastair et al [8] presented data retention analysis on Solid State Drives (SSD) with TRIM enabled file systems. The experiment conducted on SSD with three different file systems of Microsoft Windows, MAC, and Linux, namely NTFS, HFS+, and Ext4, respectively.…”

Section: Literature Review 22 Related Work / Literature Surveymentioning

confidence: 99%

SSD Forensic: Evidence Generation and Forensic Research on Solid State Drives Using Trim Analysis

Hadi

Musthaq

Khan

2021

2021 International Conference on Cyber Warfare and Security (ICCWS)

View full text Add to dashboard Cite

Traditional hard drives consisting of spinning magnetic media platters are becoming things of the past as with the emergence of the latest digital technologies and electronic equipment, the demand for faster, lighter, and more reliable alternate storage solutions is imperative. To attain these requirements, flash storage technologies like Solid State Drive (SSD) has overtaken traditional hard disk drives. In a forensic analysis of flash storage devices, forensic investigators are facing severe challenges for the reason that the sovereign behavior of solidstate storage media does not look favorable compared to traditional storage media devices. Wear Leveling, a fundamental mechanism in Solid State Drive (SSD), plays a severe challenge that most often destroys forensic evidence in many cases. It makes it complicated for forensic investigators to recover the necessary evidence.Persistence of deleted data in flash storage media depends on various factors like the Garbage Collection process, TRIM command, flash media type, manufacturer, capacity, file system, type of file saved, and the Operating System, etc. In view of this, extensive experiments conducted to identify the probability of data recovery and carving. Analyzed effects of Wear Leveling and Garbage Collection processes in Solid State Drive (SSD) of different manufacturers, having the same storage capacities and with a different type of files utilized. In conclusion, experimental findings established the fact that Wear Leveling in solid-state media can obfuscate digital evidence, and a conventional assumption regarding the behavior of storage media is no more valid. Moreover, data persistency also depends on the manufacturers, time-lapse of forensic analysis after data deletion, type of files, and size of files stored in Solid State Drives (SSD).

show abstract

A Digital Body Farm for Collecting Deleted File Decay Data

Agada

Iganibo

Jones

et al. 2022

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

TRIM, Wear Levelling and Garbage Collection on Solid State Drives: A Prediction Model for Forensic Investigators

Cited by 3 publications

References 7 publications

Security of IoT Device: Perspective Forensic/Anti-Forensic Issues on Invalid Area of NAND Flash Memory

Security of IoT Device: Perspective Forensic/Anti-Forensic Issues on Invalid Area of NAND Flash Memory

SSD Forensic: Evidence Generation and Forensic Research on Solid State Drives Using Trim Analysis

A Digital Body Farm for Collecting Deleted File Decay Data

Contact Info

Product

Resources

About