Re:Why SSD Drives Destroy Court Evidence, and What Can Be Do...
by random_number on Friday June 20, 2014 @05:33PM
(#7923020)
"I strongly suspect what you saw in this paper was Samsung's[1] auto-trim "
Yes, that was the reason for picking that drive (the research budget for the project was a mere $500!), since I was pretty confident the effect might show up from it.
However, it was a lucky guess that it would show up in the presence of a write blocker and in the time frame of a forensic investigation (normally the first thing that happens is they quickly copy the disk), since those are unusual constraints.
I think I prefer to call the technology the same as the manufacturer's name: idle garbage collection - since TRIM has a clear meaning in this context, and the drive is not automatically generating TRIM commands and it doesn't behave exactly as though the O/S had issued them either (e.g. most but not all gets wiped). Hope we can agree to disagree on that one!
Yes, that was the reason for picking that drive (the research budget for the project was a mere $500!), since I was pretty confident the effect might show up from it.
However, it was a lucky guess that it would show up in the presence of a write blocker and in the time frame of a forensic investigation (normally the first thing that happens is they quickly copy the disk), since those are unusual constraints.
I think I prefer to call the technology the same as the manufacturer's name: idle garbage collection - since TRIM has a clear meaning in this context, and the drive is not automatically generating TRIM commands and it doesn't behave exactly as though the O/S had issued them either (e.g. most but not all gets wiped). Hope we can agree to disagree on that one!
Thanks for your comment