The two most interesting insights I got from this article are that:<p>(1) SSDs are good for privacy for <i>average</i> users since
they are cleaning up dirty blocks in the background.<p>However, IMO, privacy-conscious users who are running a daily
free-space wipe, a conventional hard disk is superior
because it guarantees that all dirty blocks are erased.
A free-space wipe on an SSD can't guarantee that reserved or
remapped blocks get erased.<p>(2) He says, "<i>Somewhat counter-intuitively, information deleted
from certain types of encrypted volumes (some configurations of
BitLocker, TrueCrypt, PGP and other containers) may be easier to
recover ... if the investigator knows either the original
password or binary decryption keys for the volume</i>".<p>If you delete a file in your encrypted volume (but don't do a
free-space wipe inside your encrypted volume), then someone who
knows your key could potentially recover that file.
But that's always been true -- it's true for both SSD and
conventional drives.<p>What I think the author is saying is that someone who use an encrypted
volume doesn't benefit from the SSD's cleaning of dirty blocks
in the background because the entire encrypted volume looks like
it's in use to the SSD controller.<p>But I don't see how he concludes that it's "easier".
You lose the benefit of the SSD's garbage collection, but to recover a
deleted file from inside an encrypted volume (assuming you have the
user's key) is neither easier nor more difficult with an SSD vs. a
conventional disk.
Misleading title.<p>Newer technology has no inherrent responsibility to live by old forensic standards of past generations. A Solid State Drive (not, Solid State Drive Drive) does not "destroy" court evidence. Firstly, show me the court record where the data was first introduced. Secondly, lookup the legal terms for destroying court records/evidence then explain to me how this scenario applies.<p>Yes, I'm splitting hairs, but so does your title.
I would think that feature is an added benefit and nothing should be done about it except ensure TRIM is enabled and active. We should not be running our private lives with a goal of assisting lawsuits and prosecution, particularly actions against ourselves.
Are there any chances that governments could compel SSD manufacturers to introduce artificial backdoors allowing for data recovery?<p>Or is that a certainty?<p>I see that being pretty difficult as you would need to have 2x the storage in an SSD without being easily detected by anyone taking it apart.
For anyone that's interested - <a href="http://ro.ecu.edu.au/cgi/viewcontent.cgi?article=1124&context=adf" rel="nofollow">http://ro.ecu.edu.au/cgi/viewcontent.cgi?article=1124&contex...</a><p>The above is a terrible write-up of my undergrad research project / dissertation.
Interesting that this is essentially a fight between two arms of the government: spooks, who want to delete information forever, and cops, who never want any information deleted at all.
Hi,<p>I'm the author of the first reference cited by this article, and the coiner of the term 'self-corrosion' for this phenomenon. First of all, thank you to the author of the headline article for their interesting article and for citing our research.<p>I'd say our main findings were a little bit different to what is described in the article, though I'd agree with most of what was written there.<p>We discovered that SSD drives can wipe themselves (with their own GC) even in the absence of TRIM commands and despite the use of forensic write-blockers that block both writes and trims being sent on the ATA/SATA bus. To my mind, that's what is really shocking - you get this phenomenon even when the very best forensic tools are used and even on OS's that aren't using TRIM. (My coauthor was a professional forensic investigator armed with professional equipment).<p>For example, imagine if you had some data on your disk that was fragmented all over the disk. If the disk has a garbage collector that wants to consolidate flash sectors so it can erase the leftover space after consolidation (e.g. to improve performance), then you're going to get deleted data being purged without any TRIM command being involved after the consolidate/erase operation.<p>If I remember right (it's been a few years), some firmwares also detect fast-formatting operations in OS's that don't support TRIM and use that as a clue to trigger automatic GC. That was the really stunning one for us. A fast format by the user led to the disk wiping itself just minutes later under forensic conditions.<p>Of course this sounds great for privacy, self-wiping and so on, but the problem is that it could look like this accidental wiping was an intentional attempt to destroy evidence (e.g. manual wipe, logic bomb or something). That's where things get tricky.<p>It looks like the link isn't working, here's a working link:<p><a href="http://graemebell.net/publications//upload/bellbodd2010-preprint.pdf" rel="nofollow">http://graemebell.net/publications//upload/bellbodd2010-prep...</a><p>or<p><a href="http://researchrepository.murdoch.edu.au/3714/1/solid_state_drives.pdf" rel="nofollow">http://researchrepository.murdoch.edu.au/3714/1/solid_state_...</a><p>That paper was written for any educated person to understand, not just forensic experts, so I hope you enjoy it if you do take a look. We talk about both the technical and legal side of things in the paper.<p>Thanks for reading, and I'll check in on this comment later in case anyone has questions.
SSDs are <i>very different</i> from spinning platters. Instead of creating complicated devices that try to mimic spinning platters, why not have a different storage model entirely?
Didn't mention read disturbance. MLC and TLC flash (esp. the latter) have semi-destructive reads, so that you need to re-write a block after several thousand reads as well as on any write.<p>So you can't treat a drive as a ROM, even if you disabled physical writes somehow. Of course, you <i>probably</i> have enough read cycles available to do quite a few full scans of a drive...
"Modern SSD drives employ smart wear leveling techniques [3] that, instead of re-using existing blocks of memory, will write to a different block when data stored in a certain block is being modified."<p>Can this behavior be exploited to enable a hardware based file versioning system? For example, SSD explicitly exposes to OS, where new blocks are written and which blocks they are overwriting. This would allow FS to cheaply track multiple versions of files. When a portion of a file is overwritten with some new change, this version is discarded and SSD is instructed that rest of blocks that were storing changes for that version of the file are expendable as well. Depending on SSD capacity and usage, a simple algorithm of overwriting oldest block first, would provide several versions for each changed file virtually for free.
I'm confused why they went to the trouble of building a custom FPGA setup, you can just buy a Universal chip programmer that can read the contents of flash for around $1,000. The article also doesn't address the fact that many SSD drives encrypt data before writing it to the flash which makes this approach impossible.<p><a href="http://www.dataman.com/" rel="nofollow">http://www.dataman.com/</a>