Digital Forensics and Cyber Crime. 10th International EAI Conference, ICDF2C 2018, New Orleans, LA, USA, September 10–12, 2018, Proceedings

Research Article

Solid State Drive Forensics: Where Do We Stand?

  • @INPROCEEDINGS{10.1007/978-3-030-05487-8_8,
        author={John Vieyra and Mark Scanlon and Nhien-An Le-Khac},
        title={Solid State Drive Forensics: Where Do We Stand?},
        proceedings={Digital Forensics and Cyber Crime. 10th International EAI Conference, ICDF2C 2018, New Orleans, LA, USA, September 10--12, 2018, Proceedings},
        proceedings_a={ICDF2C},
        year={2019},
        month={1},
        keywords={SSD forensics Forensic experiments Data recovery TRIM},
        doi={10.1007/978-3-030-05487-8_8}
    }
    
  • John Vieyra
    Mark Scanlon
    Nhien-An Le-Khac
    Year: 2019
    Solid State Drive Forensics: Where Do We Stand?
    ICDF2C
    Springer
    DOI: 10.1007/978-3-030-05487-8_8
John Vieyra1,*, Mark Scanlon2,*, Nhien-An Le-Khac2,*
  • 1: Canada Border Services Agency
  • 2: University College Dublin
*Contact email: john.vieyra@ucdconnect.ie, mark.scanlon@ucd.ie, an.lekhac@ucd.ie

Abstract

With Solid State Drives (SSDs) becoming more and more prevalent in personal computers, some have suggested that the playing field has changed when it comes to a forensic analysis. Inside the SSD, data movement events occur without any user input. Recent research has suggested that SSDs can no longer be managed in the same manner when performing digital forensic examinations. In performing forensics analysis of SSDs, the events that take place in the background need to be understood and documented by the forensic investigator. These behind the scene processes cannot be stopped with traditional disk write blockers and have now become an acceptable consequence when performing forensic analysis. In this paper, we aim to provide some clear guidance as to what precisely is happening in the background of SSDs during their operation and investigation and also study forensic methods to extract artefacts from SSD under different conditions in terms of volume of data, powered effect, etc. In addition, we evaluate our approach with several experiments across various use-case scenarios.