Repository logo
 

A Study on the Impact of TRIM and Garbage Collection on Forensic Data Recoverability of SSDs at Varying Time and Disk Usage Levels

Files

Thesis(3.17 MB)

Date

2022

Authors

Varghese, Vinay Mathew

Supervisor

Nisbet, Alastair

Item type

Thesis

Degree name

Master of Information Security and Digital Forensics

Journal Title

Journal ISSN

Volume Title

Publisher

Auckland University of Technology

Abstract

The application of flash memory, as the primary storage medium, in modern computers and consumer electronics is becoming broader. Solid State Drives (SSDs), based on flash memory technology, is rapidly replacing the Hard Disk Drives which are based on conventional magnetic storage technology. Along with the many advantages including improved performance and smaller size, SSDs pose new challenges to digital forensics investigators. An SSD is considered to be self-corrosive due to its internal self-management processes which causes permanent data loss without external interference, making forensic recovery of evidence challenging. This study reviews relevant literature to understand the underlying technology of SSDs and the characteristics of the internal processes which are TRIM, garbage collection and wear leveling. Whilst many previous studies have been carried out to understand the changes that these processes impose on the data stored on SSDs, this study investigates the time variant changes in data recoverability of SSDs due to the impact of these processes. The research objectives also include understanding the change in data recoverability at varying disk usage levels. In order to fulfil the research objectives, this research interrogates whether the effects of time can be predicted on the amount of deleted data that can be recovered and what is the effect on the same as SSD disk usage increases. Experiments were conducted to collect data for analysis. The tests were carried out on five different SSDs using three different operating system/file system combinations. The analysis of the results of the experiments shows that the effect of time on the data recoverability of SSDs can be predicted. Identifiable trends were observed in the change in data recoverability of the SSDs as the disk usage progressed from one level to another. Another observation made from the findings is that larger files are more prone to permanent data loss compared to smaller files. This study also suggests possible reasons for the observed behaviour of the SSDs, in terms of data recoverability, in certain test scenarios. The knowledge acquired through this research, on the effect of time and disk usage on the amount of recoverable data, will assist forensic investigators to take adequate measures and to act in a timely manner, when the investigation involves evidence extraction from SSDs.

Description

Keywords

Source

DOI

Publisher's version

Rights statement

Permanent link

https://hdl.handle.net/10292/15501

Collections

Masters Theses