Full Program »
A Comprehensive Black-box Methodology for Testing the Forensic Characteristics of Solid-state Drives
These optimizations have a significant impact on the forensic analysis of SSDs, and in particular on data reconstruction and file carving. The main cause is that memory cells could be preemptively blanked, whereas a traditional drive sector would need to be explicitly rewritten to physically wipe off the data. Unfortunately, the existing literature on this subject is sparse and the conclusions are seemingly contradictory.
In this paper we propose a generic, practical, test-driven methodology that guides researchers and forensics analysts through a series of steps that assess the ``forensic friendliness'' of a solid-state drive under examination. Our methodology produces a valuable output that helps an analyst to determine whether or not an expensive direct acquisition of the memory cells is worth the effort, because the extreme optimizations may have rendered the data unreadable or useless. We apply our proposed methodology to three SSDs produced by top vendors (Samsung, Corsair, and Crucial), and provide a detailed description of how each step should be conducted.
Author(s):
Gabriele Bonetti
Politecnico di Milano
Italy
Marco Viglione
Politecnico di Milano
Italy
Alessandro Frossi
Politecnico di Milano
Italy
Federico Maggi
Politecnico di Milano
Italy
Stefano Zanero
Politecnico di Milano
Italy