SSD Firmware Causes Forensic Concern

After Californian researchers last month uncovered a problem with software erase programs and solid-state drives (SSDs), research from the other side of the world is pointing to a separate but related issue with the storage medium’s firmware.

The research paper, Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Discovery? by Graeme B. Bell and Richard Boddington of Murdoch University in Perth, Australia, focuses on SSD purging algorithms used to maximise performance.

No disaster recovery

The researchers quick formatted a sample Corsair 64GB SSD and a traditional magnetic Hitachi 80GB hard disk drive (HDD) for comparative purposes, expecting these purging algorithms to allow new data to be written to the SSD within about 30 minutes. But their routines ran after only 3 minutes, leaving only a few recoverable files in a very short space of time.

Even when disconnecting the drive from a PC and connecting it to a ‘write blocker,’ they found 19 percent of the SSD’s files had been irrevocably wiped after 20 minutes.

As a result, the report suggested that SSDs could “permanently destroy evidence to quite a remarkable degree… in a manner that a magnetic hard drive would not”.

Although this might sounds like a bonus from a security point of view, it said this could have forensic ramifications, if analysts are unable to capture an isolated snapshot image of a drive for investigative purposes.

The research was first published in The Journal of Digital Forensics, Security and Law last December, but was made available for general download on its website last week.

Late last month, researchers in California uncovered a separate but related data purging problem related to the way SSDs erase data from specific portions of the drive from the point of view software erase programs.