ACM Transactions on Computer Systems (TOCS)
Recovering data from USB flash memory sticks that have been damaged or electronically erased
Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop
A case for flash memory ssd in enterprise database applications
Proceedings of the 2008 ACM SIGMOD international conference on Management of data
Design tradeoffs for SSD performance
ATC'08 USENIX 2008 Annual Technical Conference on Annual Technical Conference
Flash Disk Opportunity for Server Applications
Queue - Enterprise Flash Storage
Write amplification analysis in flash-based solid state drives
SYSTOR '09 Proceedings of SYSTOR 2009: The Israeli Experimental Systems Conference
Data remanence in flash memory devices
CHES'05 Proceedings of the 7th international conference on Cryptographic hardware and embedded systems
TrueErase: per-file secure deletion for the storage data path
Proceedings of the 28th Annual Computer Security Applications Conference
A comprehensive black-box methodology for testing the forensic characteristics of solid-state drives
Proceedings of the 29th Annual Computer Security Applications Conference
The impact of the antivirus on the digital evidence
International Journal of Electronic Security and Digital Forensics
| Hi-index | 0.00 |
Data recovery techniques for platter-based disk drives have remained rather static due to the dominance of the hard disk for the last two decades. Solid State Disk drives have differing storage and recall functionality from platter-based disks and require special care when attempting data recovery. Manufacturers have varying implementations of garbage collection in each drive, which affects the amount of data retained on the disk. This paper presents an analysis of solid state disk data retention based off of empirical evidence of 16 different disks. It also discusses the data recovery problem faced by forensic examiners due to the ATA8 TRIM command, which can sanitize disks in seconds. The experiment shows that without TRIM, nearly all data is recoverable, but with TRIM enabled only up to 27% of blocks were recoverable dependent on the controller manufacturer.