Authors: Christopher King
DFRWS USA 2011
Abstract
Data recovery techniques for platter-based disk drives have remained rather static due to the dominance of the hard disk for the last two decades. Solid State Disk drives have differing storage and recall functionality from platter-based disks and require special care when attempting data recovery. Manufacturers have varying implementations of garbage collection in each drive, which affects the amount of data retained on the disk. This paper presents an analysis of solid state disk data retention based off of empirical evidence of 16 different disks. It also discusses the data recovery problem faced by forensic examiners due to the ATA8 TRIM command, which can sanitize disks in seconds. The experiment shows that without TRIM, nearly all data is recoverable, but with TRIM enabled only up to 27% of blocks were recoverable dependent on the controller manufacturer