My Interview by HTCIA for Upcoming Solid State Speech
July 6, 2011
http://htcia.wordpress.com/2011/07/06/learning-about-solid-state-drives-2-perspectives-2/
In Indian Wells come September, our Cyber Investigations/Forensics lecture track will feature two presentations on the next major trend in data storage: solid state drives, which are much more like memory than they are like conventional hard drives, and therefore much more volatile for forensic examiners.
On Monday, Sept. 12, James Wiebe of CRU-DataPort/WiebeTech (Bronze sponsor of the conference along with the 1st annual HTCIA Golf Classic) will present “Solid State Storage for Forensic Investigators.” The following day, Scott Moulton of My Hard Drive Died, LLC will present “Solid State Drives & How They Work for Data Recovery & Forensics.” We talked a little with James and Scott about their presentations and what examiners can expect:
HTCIA: How is a SSD physically different from a hard drive, and what does this mean for forensics?
JW: SSD uses silicon chips (integrated circuits) and is neither organized nor erased like conventional rotating media. As a result, investigators have new challenges in obtaining information (evidence) from SSDs.
SM: The main difference between a USB thumbdrive and a Solid State Disk (actually they are both Solid State Disks but the term has lost some of it meaning like a Gateway and a Router have) is that a thumbdrive is a host based device meaning that it uses your CPU, where a SSD has its own processor.
There are many smaller differences such as where the responsibility lies for doing management functions. The SSD drive is responsible for processing this data with only power applied and since it has a processor it can, however, a USB thumbdrive can’t because it requires your host processor to accomplish the task. For forensics, this has a great impact on how data is handled because the SSD can start running software routines on the data when only power is applied.
HTCIA to JW: What is the advantage of a SSD over conventional platters? What are the disadvantages?
JW: SSD advantages include fast start, because the drive doesn’t have to spin up, and fast random access, because there is no physical search across the drive. Parallel reads and writes are possible. There are no moving parts, so it’s silent and doesn’t consume as much power. SSDs have immunity from both shock and magnetics, and they are much smaller than conventional hard drives.
Disadvantages are more complicated. The cells have a limited lifetime, so special file systems or firmware designs can mitigate this problem by spreading writes over the entire device, called wear leveling. However, this process introduces its own issues. Wear leveling on flash SSD has encryption implications, and causes fragmentation; defragmentation is harmful because it causes additional use of the drive, wearing it out with no benefit. And for forensic exams, wear leveled sectors are outside of accessible space.
Aside from issues with wear leveling, secure wipe is difficult or impossible on flash SSD. SSDs present significant asymmetric read and write performance. SATA SSDs have writing slowness amplification, because of large block sizes. Extra commands (EG: TRIM) require additional OS overhead for best support. And SSDs are expensive.
HTCIA: Mobile forensic examiners are using “chip off” techniques to recover data from NAND solid state memory. Will this technique become common as more SSDs are adopted for PCs as well?
JW: Probably!
SM: Removing NAND chips to recover the data, I believe, will become much more complex as we continue forward. I am already seeing a large number of chips starting to use encryption to store the data on the NAND.
It is more likely in the future that we will “convince” certain companies to add diagnostic functions to allow us to read raw data. Currently, since SSDs are in their infancy, we are running into a lot of “intellectual property” issues, which might diminish over time as several companies become the winners in the industry. [At that point] they will improve their techniques, allowing better results for higher end devices, giving access to the raw data.
[At this time] none of this is really possible, but I am doubtful we will be able to continue using the RAW read techniques in the future we are using now [owing to the wear leveling process described above].
I also think it is more likely that cell phone will start using more of the SSD technology.
HTCIA: What do you project as being the timeframe for widespread adoption?
JW: I expect to see SSDs in widespread use in almost all portable computing products within the next 18 months.
SM: I think that SSDs will take over all mobile platforms over the next two years. I think that desktops and servers will remain mostly the way they are, with little change in the direction to SSD. It makes sense that SSDs will move more towards complete laptop domination, just due to their resilience to movement that often damage laptop drives.
HTCIA: What is the best way for forensic examiners to prepare for these eventualities?
JW: Why, by attending my lecture, of course! 
One big theme is that forensic examiners need to have the understanding that SSDs are far more easily erased than rotating media: Plan on acquisition quickly.
SM: My data recovery class is a great way for forensic examiners to prepare, but in addition to that I think that forensic teams will need to focus more on electronics and soldering techniques for future repairs and data collection. It is becoming very common to have to solder or desolder devices in order to repair or collect data from these devices.
HTCIA to SM: Your perspective is as a data recovery expert. Will computer forensic examiners need to take more of a “recovery” approach to data than “forensic,” as they do with mobile devices? Will this mean challenges to describe their methodology in court?
SM: I think that a forensic examiner can be greatly enhanced by understanding the media not only for acquiring the data, but for explaining it in court. I hear a number of times how much they think they know about the media and often are surprised when I start talking about items such as firmware and bad block tables how they work. These devices are completely misunderstood.
A second important fact is that most forensics begins with good data; however, without getting any data you have no case at all. Being able to acquire that data is extremely important or you are limiting your job in the future.
One example I can state is about all those forensic imaging software packages. FTK Imager or Encase will pad bad blocks with 0’s, but in data recovery we can often acquire some — if not all — of the content from a bad sector. Instead of having 0’s, we will get a more accurate image than forensic packages do.
It is very important to understand what a long read is, or what [error correction codes] do to the sector in order to get and use that data, but our result is much better than the current forensic tools that acquire images. Not understanding data recovery and relying on forensic only means puts forensic investigators at a distinct disadvantage.
As for the challenges in actual court cases, the truth of the matter is that anything we are describing is very difficult and I find that most of the time much of what we are doing will not be included in a case due to the complexity. Lawyers have often looked at the data, and the investigation components that point to how something occurred, but they will eliminate the items they think are too complex, only using the finest picture they can develop to be less confusing to make their case.
Thanks to both James Wiebe and Scott Moulton for your insights — we look forward to seeing your presentations in Indian Wells this coming September! Readers, to attend these lectures, please register for the conference here: https://www.htciaconference.org/registration.html
Image: Andres Rueda via Flickr