News for hackers. Stuff that matters.
Re:SSD firmware destroys digital evidence, researchers find by rlpb on Saturday March 05, 2011 @11:06AM (#2291666)
"Forensic analysis" as it works today on magnetic hard drives works is heavily based on the principles under which these type of drives operate. They take advantage of the fact that deleting a file does not actually delete a file on disk, as it is more efficient to simply mark those areas as unused. They are taking advantage of an optimisation that has been done for decades.

SSDs are completely different. The optimisation no longer works, since flash memory has no overwrite operation, only a block-erase operation (which is a slow operation - and the erase blocks are relatively huge). In order to stay efficient, SSDs must perform background free space management, which includes erasing unused blocks in advance in order to be ready for new data.

This should be obvious to anyone who understands how flash memory works. SSD manufacturers have no option here. It's a fundamental side-effect of the technology.

"Forensic analysis" that depends on an optimisation performed on a system using a hard drive will no longer work with a different technology that cannot use that optimisation. They were exploiting something that is not necessarily going to be possible any more.

If they want a clean equivalent of a "write blocker", they are going to have to somehow disable the SSD's background management before powering up the drive. This might not help so much though if the background management has already erased unused blocks after the user deleted files.

I will accept though that this means that people working in the field will need to change their procedures.

Summary: forensic analysis only works because of an optimisation that systems using magnetic hard drives did but systems using SSDs can't. How is this surprising?

Re:SSD firmware destroys digital evidence, researchers find by kovar on Saturday March 05, 2011 @11:12AM (#2291677)
It also means that the courts will need to accept that the image taken of an SSD will not match a second image. The courts, and the computer forensics community, had a hard time accepting collecting RAM but that's now a pretty standard part of the process. It will be easy to extend RAM analysis procedures to SSDs.
Re:SSD firmware destroys digital evidence, researchers find by kragen on Saturday March 05, 2011 @12:28PM (#2291835)
What is this about collecting RAM? Are you saying that if someone's office gets audited for compliance, they'll power off their machines, freeze-spray their DIMMs, extract them, and put them into a DIMM reader to image the RAM contents?
Re:SSD firmware destroys digital evidence, researchers find by kovar on Saturday March 05, 2011 @12:38PM (#2291864)
When collecting evidence from computers, the policy used to be "power it down, and do dead-drive forensics". Over the last few years, this has shifted to "grab RAM and only then consider powering it down."

Memory contains all sorts of potential evidence, from encryption keys to malware to passwords. Failing to collect this information can significantly hamper or even kill an investigation.

The research into freezing and then extracting RAM contents was interesting, but not terribly practical.

Re:SSD firmware destroys digital evidence, researchers find by extension on Saturday March 05, 2011 @12:16PM (#2291807)
I wouldn't call it an optimization. Generally, the fastest way to logically delete data is to just forget that it's there. RAM works the same way, as would any other medium that doesn't have any special requirements for writing.

Flash is the unusual case since it needs to be "flashed" in bulk before it can be rewritten.

Re:SSD firmware destroys digital evidence, researchers find by kragen on Saturday March 05, 2011 @12:37PM (#2291860)
> Generally, the fastest way to logically delete data is to just forget that it's there. RAM works the same way, as would any other medium that doesn't have any special requirements for writing.

Many media have special requirements for writing. It's true that DRAM and SRAM don't have a separate "erased" state, and neither do fuse PROM, core memory, Williams tubes, acoustic delay lines, or magnetic disk and tape.

But CD-R, Flash, CD-RW, rewritable magneto-optical disks, two-photon storage, and some other memory types have a distinct "erased" state; in some cases, you can't even return to that state. I'm not sure about MRAM, FeRAM, PRAM, and hypothetical memristive memories.

Re:SSD firmware destroys digital evidence, researchers find by reemrevnivek on Saturday March 05, 2011 @06:40PM (#2292856)
The reason for erasing data is generally to free up space so new data can be written.

Whether this erase procedure happens immediately upon the user's request to delete the information or whether it's added to a queue of areas to erase (the "purging routines" or "garbage collection" mentioned in the article) is a small detail. A modern OS will return control to the user immediately upon issuing the command, and all that matters to the end user is that the erase command is issued before the next write. A firmware

I seriously hope that these researchers aren't advocating a mandate that states that the erase procedure cannot be issued until a write is requested to that space.

Re:SSD firmware destroys digital evidence, researchers find by rlpb on Saturday March 05, 2011 @01:06PM (#2291926)
I think that's just an argument about semantics. You say "fastest". If you ignore that and just do it the dumb way, then you're deleting data by overwriting it. Making it "fastest" is the optimisation.

In any case, I still think your point is valid despite disagreeing with you, and I think it's disappointing that you just received a downmod. I've just upvoted you back to 1.

Re:SSD firmware destroys digital evidence, researchers find by kragen on Sunday March 06, 2011 @10:40AM (#2294324)
In NOR Flash, if you overwrite data, the result is the AND (or the OR) of the old data and the new data; that is, you can write 0 bits, but not 1 bits. Erasing is a separate and much, much slower process, which is why it's done a sector at a time instead of a bit at a time.

In NAND flash, overwriting isn't even an option, although I don't understand why.