SSD Forensic: Evidence Generation And Forensic Research On Solid State Drives Using Trim Analysis

Traditional hard drives consisting of spinning magnetic media platters are becoming things of the past as with the emergence of the latest digital technologies and electronic equipment, the demand for faster, lighter, and more reliable alternate storage solutions is imperative. To attain these requirements, flash storage technologies like Solid State Drive (SSD) has overtaken traditional hard disk drives. In a forensic analysis of flash storage devices, forensic investigators are facing severe challenges for the reason that the sovereign behavior of solid-state storage media does not look favorable compared to traditional storage media devices. Wear Leveling, a fundamental mechanism in Solid State Drive (SSD), plays a severe challenge that most often destroys forensic evidence in many cases. It makes it complicated for forensic investigators to recover the necessary evidence. Persistence of deleted data in flash storage media depends on various factors like the Garbage Collection process, TRIM command, flash media type, manufacturer, capacity, file system, type of file saved, and the Operating System, etc. In view of this, extensive experiments conducted to identify the probability of data recovery and carving. Analyzed effects of Wear Leveling and Garbage Collection processes in Solid State Drive (SSD) of different manufacturers, having the same storage capacities and with a different type of files utilized. In conclusion, experimental findings established the fact that Wear Leveling in solid-state media can obfuscate digital evidence, and a conventional assumption regarding the behavior of storage media is no more valid. Moreover, data persistency also depends on the manufacturers, time-lapse of forensic analysis after data deletion, type of files, and size of files stored in Solid State Drives (SSD)

SimpleSSD: Modeling Solid State Drives for Holistic System Simulation

Existing solid state drive (SSD) simulators unfortunately lack hardware and/or software architecture models. Consequently, they are far from capturing the critical features of contemporary SSD devices. More importantly, while the performance of modern systems that adopt SSDs can vary based on their numerous internal design parameters and storage-level configurations, a full system simulation with traditional SSD models often requires unreasonably long runtimes and excessive computational resources. In this work, we propose SimpleSSD, a highfidelity simulator that models all detailed characteristics of hardware and software, while simplifying the nondescript features of storage internals. In contrast to existing SSD simulators, SimpleSSD can easily be integrated into publicly-available full system simulators. In addition, it can accommodate a complete storage stack and evaluate the performance of SSDs along with diverse memory technologies and microarchitectures. Thus, it facilitates simulations that explore the full design space at different levels of system abstraction.Comment: This paper has been accepted at IEEE Computer Architecture Letters (CAL

Solid State Drive

This project documents the design and implementation of a solid state drive (SSD). SSDs are a non-volatile memory storage device that competes with hard disk drives. SSDs rely on flash memory, a type of non-volatile memory that is electrically erased and programmed. The appeal of SSDs lies in the fact that they allow a fast, reliable, and durable memory storage device. The goal of this project is to have a working external SSD built from scratch

ANALISIS LIVE FORENSICS PADA SSD SATA FUNGSI TRIM MENGGUNAKAN METODE NATIONAL INSTITUTE OF JUSTICE (NIJ)

Perkembangan teknologi yang kian pesat diiringi juga dengan kejahatan komputer yang meningkat. Dilansir dari Kepolisian Republik Indonesia, dalam rentang waktu April 2020 hingga Juli 2021 instansi tersebut mendapat laporan sebanyak 937 kasus. Digital Forensics atau Forensika Digital adalah cabang ilmu sains yang menginvestigasi  barang  bukti  digital  untuk  kemudian  mengumpulkan, memulihkan, dan menganalisa barang bukti tersebut . Teknik/analisis yang digunakan untuk mengungkap kejahatan komputer tersebut salah satunya adalah Live Forensics. Melakukan pemulihan data dalam penaganan kasus kejahatan komputer ketika sistem komputer dalam keadaan hidup adalah penerapan metode Live. Penelitian ini menggunakan metode yang sering digunakan yaitu metode National Institute of Justice (NIJ). National Institute of Justice (NIJ) merupakan metode yang digunakan untuk menjelaskan bagaimana tahapan penelitian yang dilakukan sehingga alur penelitian bisa selesai secara sistematis dan dapat dijadikan pedoman dalam menyelesaikan permasalahan yang ada. Tujuan dari penelitian ini adalah mengetahui tahapan pemeriksaan dan analisis pada SSD yang memiliki fungsi TRIM.Terlepas dari segala manfaat maupun keuntungan yang terdapat pada Solid State Drive (SSD) tentu saja SSD ini memiliki keterbatasan.Hasil  penelitian  dan  analisis  menggunakan perangkat lunak Autopsy dan Testdisk yaitu seluruh file berhasil dipulihkan secara sempurna dengan persentasi keakuratan 90 %. Keyword: Forensic,Solid State Drive,Kemanan Informas

SSD Admission Control for Content Delivery Networks

Content delivery networks (CDNs) are utilized to deliver content with low latency. Solid State Drive (SSD) devices are a cost-effective option for intermediate tier caches in servers used in CDNs. However, excessive writes of content to SSD devices can degrade useful life of such devices. This disclosure describes admission control techniques to manage content in an SSD cache. In particular, a popularity metric for content items is determined based on an inter-arrival time. The popularity metric takes into account past admission history and is dynamically to account for variations in content popularity over different time periods. These techniques balance the SSD cache write rates to optimize the device life and cache performance

Performance Analysis of NAND Flash Memory Solid-State Disks

As their prices decline, their storage capacities increase, and their endurance improves, NAND Flash Solid-State Disks (SSD) provide an increasingly attractive alternative to Hard Disk Drives (HDD) for portable computing systems and PCs. HDDs have been an integral component of computing systems for several decades as long-term, non-volatile storage in memory hierarchy. Today's typical hard disk drive is a highly complex electro-mechanical system which is a result of decades of research, development, and fine-tuned engineering. Compared to HDD, flash memory provides a simpler interface, one without the complexities of mechanical parts. On the other hand, today's typical solid-state disk drive is still a complex storage system with its own peculiarities and system problems. Due to lack of publicly available SSD models, we have developed our NAND flash SSD models and integrated them into DiskSim, which is extensively used in academe in studying storage system architectures. With our flash memory simulator, we model various solid-state disk architectures for a typical portable computing environment, quantify their performance under real user PC workloads and explore potential for further improvements. We find the following: * The real limitation to NAND flash memory performance is not its low per-device bandwidth but its internal core interface. * NAND flash memory media transfer rates do not need to scale up to those of HDDs for good performance. * SSD organizations that exploit concurrency at both the system and device level improve performance significantly. * These system- and device-level concurrency mechanisms are, to a significant degree, orthogonal: that is, the performance increase due to one does not come at the expense of the other, as each exploits a different facet of concurrency exhibited within the PC workload. * SSD performance can be further improved by implementing flash-oriented queuing algorithms, access reordering, and bus ordering algorithms which exploit the flash memory interface and its timing differences between read and write requests

Using 3D NAND Flash Memory in SSDs to Improve Storage and Performance

[excerpt] In the rapid development process of data storage, 3D NAND is the next generation of this technology in which the semiconductor flash cells of the solid-state drive (SSD) are stacked vertically to increase storage density and read / write efficiency. Originally announced by Toshiba in 2007, but with Samsung creating the first commercially available 3D NAND SSD in 2013, the technology is still extremely new to the market. Despite this, it has already proven to be far more effective and reliable than its 2D NAND counterpart. However, the question remains is it worth the upgrade

Classifying SSD input-output streams to optimize storage overprovisioning

The data update mechanism for a solid-state drive (SSD) involves overprovisioning, e.g., a storage footprint larger than the actual data size, and write amplification, e.g., a physical amount of information written being a multiple of the actual amount of information. Both overprovisioning and write amplification overheads are at least partially a result of treating input data streams as statistically indistinguishable streams and subjecting them to fixed, pre-configured provisioning. This disclosure describes techniques to classify the input-output streams of an SSD into various types, e.g., non-overlapped sequential data, chunked data streams of variable length, etc. Overprovisioning is optimized for each input stream based on its classification. The techniques thereby reduce both overprovisioning and write amplification overheads, resulting in SSD life and throughput that is significantly better than conventional techniques

Modeling of Rf Interference Caused by Solid-State Drive Noise

In this paper, modeling of RFI problem caused by a solid-state drive (SSD) in a laptop is proposed. Two noise sources (one outside and one inside a cavity) in the SSD are reconstructed as dipole moments with magnitude-only near-field scanning data. The dipole moment inside a cavity is then replaced by a Huygens\u27 box covering four side surfaces of the cavity using a numerical simulation. The noise voltage at an RF antenna port is calculated by combining the two reconstructed noise sources with measured transfer functions. The model is successfully validated through a comparison of the calculation with measurement results