Re:SSD firmware destroys digital evidence, researchers find
by stcredzero on Saturday March 05, 2011 @04:09PM
(#2292435)
The whole (rather breathless) point of the article is that SSDs erases the blocks quite rapidly.
Yes, so the proper way to analyse an SSD is to just access what's in the flash chips directly. Such methods and equipment will probably need to be developed specifically for each SSD controller chipset. Also, investigators will need to get to an SSD sooner.
The (a) case is likely OSes using the "trim" command and the (b) cases are inherent in how SSD firmware works (by necessity). WRT the (b) case, SSDs have to garbage collect. Their write speed, and thus user satisfaction, is dependent on it keeping a large number of erased blocks ready to be written to.
[1] http://www.forensicswiki.org/wiki/Write_Blockers - apparently simply a "man in the middle" hardware that filters out write commands, lets through read commands.
Obviously, there is no reasonable way for a SDD to even know that a "write blocker" is attached, so it is not surprising (to me) that the SDD garbage collects with it attached.