Solid State Drives will Ruin Forensics Part 1/5

Data Recovery and Information about Solid State Devices and NAND Flash Memory. This is about two years of research about how these devices work and what will change with forensics and data recovery jobs in the future. This was preformed in August 2008 at Defcon 16.

Category:

Science & Technology

Tags:

• Data
• Defcon16
• Devices
• Drives
• FLASH
• NAND
• Recovery
• Solid
• SSD
• State

[SuperFlyFlippingA]

I agree with you 100%. It is important to move forward and roll with the times. However, when you submit a speech to a conference you have to have a little bit of sensationalism or you don't get the speech accepted.

I would also say that I agree with you about SSD being more reliable. However, they will ruin the current Data Recovery Companies. Forensic guys are always worried about drives being wiped as well. Now the device does it. No unallocated or slack space might ruin forensics.

[rangersparky1284]

I LOLed with the porn animation :D

[matttaf]

MY PORN MACHINE NOOOOOOOOO!!!!!!! IMAOOO

[FeeLtheHertZ]

Then get a new job, technology evolves which is good tho, so then people like this guy where will have to, too! Otherwise I say boohoo, or bummer

[pyrioncelendil]

@bigboom273 not quite, file deletion typically only involves removing references to the file in the file system but actually leaving the data there (as actually zeroing out the space taken up by the file can be quite time-consuming). This is due to there being no performance impact to overwriting data on magnetic storage, whereas with SSDs the cells have to be emptied before they can be filled again. Thus SSDs have to conduct background garbage collection on the empty cells.

[bigboom273]

ok so im in the first 3 minutes of the video...and he pretty much said that when the file is deleted..the data isnt available to see on the drive, like it was wiped. well...DUH! tdats what the word "delete" means! its just that with regular hard drives thats not what "delete" means. correct me if im wrong, ive only watched the first few minutes.

[viper08v10]

Its called Trim and garbge collect



[rockmasterflex]

@SuperFlyFlippingA

Because it was always so hard to drill through a Hard Disk anyway? As long as people continue to be retarded en masse, they wont erase their data,

[Albinorama]

I was a subscriber to your videos and loved all of them, but I think you are quit wrong when you say "..will ruin..", the worlds should be "..will change..".I realize that you may lose your job or money, but that's because you dont MOVE forward and CHANGE your future and bussines.SSD are much better, perhaps rather quite dificult to fix, but you must adapt and evolve.Otherwise, you are the one who is ruin.

Cheers and thanks for all the videos.Bye.