Black-box forensic and antiforensic characteristics of solid-state drives

Journal of Computer Virology and Hacking Techniques

Volumn 10, Issue 4, 2014, Pages 255-271

  Bonetti, Gabriele ^a   Viglione, Marco ^a   Frossi, Alessandro ^a   Maggi, Federico ^a   Zanero, Stefano ^a  

^a POLITECNICO DI MILANO   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

DECISION TREES; DRIVES; SEMICONDUCTOR STORAGE; TREES (MATHEMATICS);

ANTI-FORENSICS; BLACK BOXES; DATA OPTIMIZATION; DIRECT ACQUISITION; FORENSIC ANALYSIS; GARBAGE COLLECTION; SOLID STATE DRIVES; WEAR LEVELING;

DIGITAL STORAGE;

EID: 84941204024     PISSN: 22742042     EISSN: 22638733     Source Type: Journal    
DOI: 10.1007/s11416-014-0221-z     Document Type: Article

References (20)

1. Wear leveling in micron NAND flash memory. Tech. Rep. TN-29-61, Micron Technology Inc. (2008). http://www.micron.com/~/media/Documents/Products/Technical
2. Wear-leveling techniques in NAND flash devices. Tech. Rep. TN-29-42, Micron Technology Inc. (2008). http://www.micron.com/~/media/Documents/Products/Technical
3. Microsoft Co.: Support and Q&A for Solid-State Drives. MSDN Blog (2009). http://blogs.msdn.com/b/e7/archive/2009/05/05/support-and-q-a-for-solid-state-drives-and.aspx
4. Antonellis, C.J.: Solid state disks and computer forensics. ISSA J. 6(7), 36–38 (2008)
5. Bell, G.B., Boddington, R.: Solid state drives: the beginning of the end for current practice in digital forensic recovery? J. Digit. Forensics Secur. Law 5(3), pp. 1–20 (2010)
6. Billard, D., Hauri, R.: Making sense of unstructured flash-memory dumps. In: SAC ’10, pp. 1579–1583. ACM, New York (2010)
7. Bonetti, G., Viglione, M., Frossi, A., Maggi, F., Zanero, S.: A comprehensive black-box methodology for testing the forensic characteristics of solid-state drives. In: Proceedings of the Annual Computer Security Applications Conference (ACSAC). ACM (2013). doi:10.1145/2523649.2523660
8. Breeuwsma, M., De Jongh, M., Klaver, C., Van Der Knijff, R., Roeloffs, M.: Forensic data recovery from flash memory. Small Scale Digit. Device Forensics J. 1, 1–17 (2007)
9. Bunker, T., Wei, M., Swanson, S.: Ming II: a flexible platform for NAND flash-based research. Tech. Rep. CS2012-0978, UCSD CSE (2012)
10. Chang, Y.H., Hsieh, J.W., Kuo, T.W.: Improving flash wear-leveling by proactively moving static data. IEEE Trans. Comput. 59(1), 53–65 (2010)
11. Diesburg, S., Meyers, C., Stanovich, M., Mitchell, M., Marshall, J., Gould, J., Wang, A.I.A., Kuenning, G.: Trueerase: per-file secure deletion for the storage data path. In: Proceedings of the 28th Annual Computer Security Applications Conference, ACSAC ’12, pp. 439–448. ACM, New York (2012). doi:10.1145/2420950.2421013
12. Gray, J., Fitzgerald, B.: Flash disk opportunity for server applications. Queue 6(4), 18–23 (2008)
13. Hu, X.Y., Eleftheriou, E., Haas, R., Iliadis, I., Pletka, R.: Write amplification analysis in flash-based solid state drives. In: SYSTOR ’09, pp. 10:1–10:9. ACM, New York (2009)
14. Intel: AP-684: Understanding the flash translation layer (FTL) specification. Intel Application Note. (1998) http://www.jbosn.com/download_documents/FTL_INTEL.pdf
15. King, C., Vidas, T.: Empirical Analysis of Solid State Disk Data Retention When Used with Contemporary Operating Systems, pp. S111–S117. Elsevier Science Publishers B. V., Amsterdam (2011)
16. Luck, J., Stokes, M.: An integrated approach to recovering deleted files from nand flash data. Small Scale Digit. Device Forensics J. 2(1), 1941–6164 (2008)
17. Rajgarhia, A., Gehani, A.: Performance and extension of user space file systems. In: Proceedings of the 2010 ACM Symposium on Applied Computing, SAC ’10, pp. 206–213. ACM, New York (2010). doi:10.1145/1774088.1774130
18. Skorobogatov, S.P.: Data remanence in flash memory devices. In: Cryptographic Hardware and Embedded Systems—CHES 2005, 7th Intl. Workshop, Edinburgh, UK, August 29–September 1, 2005, Proc., Lecture Notes in Computer Science, vol. 3659, pp. 339–353. Springer, Berlin (2005)
19. Templeman, R., Kapadia, A.: Gangrene: exploring the mortality of flash memory. In: HotSec’12, pp. 1–1. USENIX Association, Berkeley (2012)
20. Wei, M., Grupp, L.M., Spada, F.E., Swanson, S.: Reliably erasing data from flash-based solid state drives. In: FAST’11, pp. 8–8. USENIX Association, Berkeley (2011)