Authors: Jan Peter van Zandwijk
DFRWS EU 2017
Abstract
The value of bit-errors as a source of forensic information is investigated by experiments on isolated NAND-flash chips and USB thumb-drives. Experiments on isolated NAND-flash chips, programmed directly using specialized equipment, show detectable differences in retention bit-errors over forensically relevant time periods with the device used within manufacturer specifications. In experiments with USB thumb-drives, the controller is used to load files at different times onto the drives, some of which have been subjected to stress-cycling. Retention bit-error statistics of memory pages obtained by offline analysis of NAND-flash chips from the thumb-drives are to some extent linked to the time files are loaded onto the drives. Considerable variation between USB thumb-drives makes interpretation of bit-error statistics in absolute sense difficult, although in a relative sense bit-error statistics seems to have some potential as an independent side-channel of forensic information.