An SSD is a form of nonvolatile storage for the operating system which makes use of the solid state flash memory for storing data. It has the ability to store data and retrieve it even after the power supply has been cut off, which makes SSD a very reliable and favorable storage device as compared to its predecessors. It has no moving parts. Hence, it cannot be called the hard drive in the traditional sense. SSDs are also preferred because of their better input/output performance and can take a greater workload because of their efficiency in operation. One major difference that accompanies the extraction of data from SSD as compared to HDD that make use of the magnetic media that made data much easier to be extracted. Therefore instead of making use of the predictable extraction of data from the former hard drives, today the SSD make use of stochastic forensics in order to export data from them. (Gubanov and Afonin, 2012).
SSDs today provide less room for assumptions for technologists, and all the investigator can positively hope is just to be able to extract the data that is presently available on the disc. It is not possible to retrieve lost information that a person might have deleted or tried to destroy for instance by using the Quick Format – even, in that case, it would not be possible to extract the data that has been lost. Also, if the computer or device is switched off right after a ‘delete’ command has been given even in the Quick Format, there cannot be any easy or simple way to retrieve the data that has been lost or deleted. (Gubanov and Afonin, 2012).
The reason for this development is the presence of the flash memory in the SSDs. It is one of the design limitations of the SSDs responsible for the difficulty in performing forensics on these drives. (Weibi, 2013).
There is a great deal of wearing in these drives as they are much more complicated in their operations. Flash chips are at times more complicated and not well understood. The complication results from the ability of the flash chips used in the SSDs cause memory to be stored in the SSDs in random sectors in any part of the physical structure of the SSDs. There is an absence of linear placing and structuring in an SSD. Also, the producers of the operating systems and the manufacturers of the SSDs have installed new commands into the SSDs which produced a more streamlined and aligned functioning of the SSD that also improves the performance and at the same time makes it more difficult to extract deleted files on the drive. (Weibi, 2013).
Hence, the issue with the SSD is its ability to clear the content it has stored on it after the power is turned on right after a command has been given to clear or delete files stored on the system. There is a self-destruction process which is present in the SSD, which cannot be stopped and recovered, and the only way it can be recovered is if there is a court order issued to retrieve evidence that is extremely crucial for a case. (Gubanov and Afonin, 2012).
The other command that triggers its self-destruction is the TRIM command that is run by the operating system to the SSD, which is given when the user deletes any file or program on the system. The TRIM operation is synced with the partition and volume of the commands of the SSD. Therefore, it is an intrinsic part of the formatting of the disc and the partition process involved, and hence, if something is deleted, then the TRIM command will accentuate its difficulty of recovery. However, de-chipping- a process that removes the flash memory from the SSD is a method that can be employed by forensic investigators which then makes the data get distributed into blocks that can then be observed in an SSD however these too are only logical files that are of little use when the data is once deleted. (Weibi, 2013).
References
Gubanov, Yuri, Afonin, Oleg. (2012). “Why SSD drives destroy court evidence and what can be
done about it.” Belkasoft. Retrieved from https://belkasoft.com/why-ssd-destroy-court-evidence
Weibi, James. (2013). “Forensic Insight into Solid State Drives.” Digital Forensic Investigator.
Retrieved from http://www.forensicmag.com/articles/2013/05/forensic-insight-solid-state-drives
