Re:SSD firmware destroys digital evidence, researchers find
by kovar on Saturday March 05, 2011 @11:12AM
(#2291677)
It also means that the courts will need to accept that the image taken of an SSD will not match a second image. The courts, and the computer forensics community, had a hard time accepting collecting RAM but that's now a pretty standard part of the process. It will be easy to extend RAM analysis procedures to SSDs.
[ Parent
| on HN ]
Re:SSD firmware destroys digital evidence, researchers find
by kragen on Saturday March 05, 2011 @12:28PM
(#2291835)
What is this about collecting RAM? Are you saying that if someone's office gets audited for compliance, they'll power off their machines, freeze-spray their DIMMs, extract them, and put them into a DIMM reader to image the RAM contents?
Re:SSD firmware destroys digital evidence, researchers find
by kovar on Saturday March 05, 2011 @12:38PM
(#2291864)
When collecting evidence from computers, the policy used to be "power it down, and do dead-drive forensics". Over the last few years, this has shifted to "grab RAM and only then consider powering it down."
Memory contains all sorts of potential evidence, from encryption keys to malware to passwords. Failing to collect this information can significantly hamper or even kill an investigation.
The research into freezing and then extracting RAM contents was interesting, but not terribly practical.