±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 35765
New Yesterday: 3 Visitors: 114

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Data Recovery on SSD

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

north
Member
 

Data Recovery on SSD

Post Posted: Apr 14, 18 10:40

Why Data Recovery on SSD Is More Difficult than That on HDD?  
 
  

jaclaz
Senior Member
 

Re: Data Recovery on SSD

Post Posted: Apr 14, 18 11:29

- north
Why Data Recovery on SSD Is More Difficult than That on HDD?


Is it?

Talking of functional devices, there is not that much difference AFAICT.

What may make a BIG difference is TRIM and garbage collection, but the difference is not much about data recovery (which procedures remains the same), it revolves more about (deleted) data persistence and (possibly) increased fragmentation.

If you prefer on a normal hard disk, with a couple (manual) interventions (deleted) data can be actually deleted or partially shredded/corrupted, all that is needed is a defrag and the creation/saving of one or more "huge" files, while on SSD's the OS (or SSD controller) built-in provisions have almost the same effects in an automatic way that is transparent to the users.

Additionally DRAT and/or DZAT may make released blocks appear as zero or *whatever* independently from the actual block contents, unless chip-off extraction is used, see:
Code:
https://belkasoft.com/download/info/SSD Forensics 2014.pdf

BTW, chip-off reading (and decoding data from "raw" chip contents dumps) may be not "easy-peasy", still it seems like way easier and feasible than attempting to recover data directly from a hard disk plate.

And - to be fair - there is over provisioning that may actually increase the amount of retrievable data (still in the case of chip-off)

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 1 of 1