Notifications
Clear all

SSD as cache

4 Posts
3 Users
0 Likes
702 Views
(@c-wawrentowicz)
Posts: 26
Eminent Member
Topic starter
 

I have got two disk images from one computer (laptop). First HD is harddrive 500GB, second SSD 16GB. The SSD disk is not recognized by Encase or FTK Imager. I think that SSD disk worked as cache and I am looking for way to prove it. Is any standard signature for cache disk or vendors use own standards ?

 
Posted : 09/02/2016 1:27 pm
aeiforensics
(@aeiforensics)
Posts: 27
Eminent Member
 

Are you able to open the image to look at the hex? There has to be a file system of some sort laid down to the drive. If the image isn't opening (i.e., corrupt), does it verify?

 
Posted : 09/02/2016 7:08 pm
(@c-wawrentowicz)
Posts: 26
Eminent Member
Topic starter
 

I can attache this image in Encase and look at it in hex. I see some strings like on the system drive.
that is why I think that this drive is not encrypted.

 
Posted : 09/02/2016 9:38 pm
Passmark
(@passmark)
Posts: 376
Reputable Member
 

Find our what model laptop it was and see if the specs for the unit mention "Intel Smart Response Technology" (SRT)

See,
http//www.intel.com/content/www/us/en/architecture-and-technology/smart-response-technology.html

For SRT the caching is done at the block level (not entire files). So I would expect that you would find only fragments of files on the SSD.

Further is give priority to caching boot data and common executable files. Meaning that much of the data might appear like random data (as it will be executable code from .exe files).

If entire files are not being cached, then you probably won't find a normal file system on the SSD.

 
Posted : 10/02/2016 8:41 am
Share: