Research Article
Solid State Drive Forensics: Where Do We Stand?
@INPROCEEDINGS{10.1007/978-3-030-05487-8_8, author={John Vieyra and Mark Scanlon and Nhien-An Le-Khac}, title={Solid State Drive Forensics: Where Do We Stand?}, proceedings={Digital Forensics and Cyber Crime. 10th International EAI Conference, ICDF2C 2018, New Orleans, LA, USA, September 10--12, 2018, Proceedings}, proceedings_a={ICDF2C}, year={2019}, month={1}, keywords={SSD forensics Forensic experiments Data recovery TRIM}, doi={10.1007/978-3-030-05487-8_8} }- John Vieyra
Mark Scanlon
Nhien-An Le-Khac
Year: 2019
Solid State Drive Forensics: Where Do We Stand?
ICDF2C
Springer
DOI: 10.1007/978-3-030-05487-8_8
Abstract
With Solid State Drives (SSDs) becoming more and more prevalent in personal computers, some have suggested that the playing field has changed when it comes to a forensic analysis. Inside the SSD, data movement events occur without any user input. Recent research has suggested that SSDs can no longer be managed in the same manner when performing digital forensic examinations. In performing forensics analysis of SSDs, the events that take place in the background need to be understood and documented by the forensic investigator. These behind the scene processes cannot be stopped with traditional disk write blockers and have now become an acceptable consequence when performing forensic analysis. In this paper, we aim to provide some clear guidance as to what precisely is happening in the background of SSDs during their operation and investigation and also study forensic methods to extract artefacts from SSD under different conditions in terms of volume of data, powered effect, etc. In addition, we evaluate our approach with several experiments across various use-case scenarios.
