Australian Digital Forensics Conference
Document Type
Conference Proceeding
Publisher
SRI Security Research Institute, Edith Cowan University, Perth, Western Australia
Abstract
Solid State Drives offer significant advantages over traditional hard disk drives. No moving parts, superior resistance to shock, reduced heat generation and increased battery life for laptops. However, they are susceptible to cell failure within the chips. To counter this, wear levelling is used so that cells are utilised for data at approximately the same rate. An improvement to the original wear levelling routine is TRIM, which further enhances the lifetime of the cells by allowing the garbage collection process as one operation rather than an on going process. The advantages of TRIM for the user is that it increases efficiency of the drive’s wear levelling algorithms, meaning quicker access times and longer lifetimes. The basic wear levelling routines have caused significant difficulties for forensic investigators as data is moved to different random locations without user input. Whilst this problem has been examined in past research, the implementation of TRIM has not had much attention. This research examines SSD drives across three TRIM enabled file systems, Windows, Linux and MAC OS X operating systems. The results show that TRIM leaves far less data for forensic investigators than drives without TRIM enabled.
DOI
10.4225/75/57b3d766fb873
Comments
11th Australian Digital Forensics Conference. Held on the 2nd-4th December, 2013 at Edith Cowan University, Perth, Western Australia