SSD firmware destroys digital evidence, researchers find

Re:SSD firmware destroys digital evidence, researchers find by rbanffy on Saturday March 05, 2011 @11:19AM (#2291689)

I strongly suspect that, in the future, SSDs will have to respect a "cooperate with the police" signal in order to be sold in some places. As for drives that don't, experts can always disassemble the drive and read the memories directly. It's not like the flash memories inside them are special (albeit it's a matter of time - if not already - that smart memory controllers are built into the chips themselves).

[ Parent | on HN ]

Re:SSD firmware destroys digital evidence, researchers find by pyre on Saturday March 05, 2011 @11:36AM (#2291720)

  >  disassemble the drive and read the memories directly

What will this accomplish if the data has actually been erased? Some sort of low-level analysis to recover erased data? That seems like something that would only be at the CIA/NSA level, and they probably wouldn't want to tip their hand just to put a 'common criminal' behind bars.

[ Parent | on HN ]

Re:SSD firmware destroys digital evidence, researchers find by rbanffy on Saturday March 05, 2011 @06:25PM (#2292803)

> What will this accomplish if the data has actually been erased?

You can, at least, recover files the owner of the disk just erased before being handcuffed.

It would be trivial to setup a background task that overwrites all free blocks of the (physical) disk when the drive is idle. Or insert that in the filesystem driver, to be done when a file is erased. You could even maintain two write queues, one high-priority for the data you want to keep, one low-priority for the data you want not to keep.

[ Parent | on HN ]