Solid State Drives (SSDs) present many problems to digital forensic investigators due to the unpredictability of deleted evidence and the drive’s inner processes. These inner processes, such as wear leveling and garbage collection, are deployed by the drive’s controller chip and cannot be disabled by a user. Due to this, SSDs behave much differently than Hard Disk Drives (HDDs), and can result in varying forensic hash values and recoverability of files. This session dives into how SSDs operate differently from HDDs, the current state of SSD forensics, and best practices for forensic acquisition of SSDs.
Differentiate between the hardware, data storage, and forensics procedures of hard disk drives (HDDs) and solid state drives (SSDs).
Describe SSD inner processes and their affect on digital forensics and data recovery, such as TRIM, wear leveling, and garbage collection.
Describe various techniques for imaging SSDs, and possible future solutions. Also, be able to conduct forensic analysis of SSDs with the highest rates of recovery for deleted files.
Demonstrate knowledge on how variables such as write blockers, TRIM, and automount affect the recoverability of deleted evidence.