As a technology professional, I’ve spent my career dealing with data. In my days in the trenches of IT, I worried about the systems housing it being online and available. When I moved into application development, I worried about how to get it to the users faster. When I found myself with the burden of security, I worried about how to keep it only in the hands of my users. When I eventually wound up in forensics and eDiscovery, I worried about how to locate the data I needed and then producing it to stakeholders. Now that I’ve taken a role managing the IT operations for, a company specializing in computer forensics, I find all of the concerns from my past are back for an extended visit. So my interest was definitely peeked when a couple research papers crossed my desk over the last couple weeks.
A colleague in the forensics practice side of my company sent me a link from the Journal of Digital Forensics and Law for a paper by Graeme B. Bell and Richard Boddington entitled “Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery?”. The paper poses this worrisome title as a result of observing the behavior of an SSD formatted with an NTFS file system after modifications were made to the file system. They watched it clean the unallocated space and deleted areas without operating system intervention, both when it was connected directly to the computer and when it was connected through a write blocker device. For reasons not fully known, the device appeared to be smart enough to independently identify areas not in use and actively empty the contents. In the world of traditional data forensics, this behavior is considered bad. This is because much of the most valuable forensic data is found within these target areas of media. As would be expected, this paper has made fast rounds of the forensic discussion lists and forums and has caused quite a stir.
But then, on the exact same day, I received a reference to another paper published out of the University of California at San Diego by Michael Wei, et al., with the rather subdued title, “Reliably Erasing Data From Flash-Based Solid State Drives”. This paper essentially said just the opposite of the first paper although it used different methodology. These researchers put forth that even though data was supposedly wiped from a hard drive using a variety of methods, if the physical drive was disassembled and the flash chips were examined, due to various mechanisms within the SSD controller, often several copies of the data existed and a significant amount was able to be recovered in a full or partial state. The paper in general is focused on the methods used to sterilize a device needs reevaluation, but the implications extend far beyond just the stated goals.
Obviously, this is not the first time we have seen experts in their respective fields take diametrically opposed positions on something. But what does it mean for those of us who have to make purchase decisions, evaluate cost-benefit, and put our names on the line to keep data secure yet available? I see the answer from two distinct, yet compatible points of view. First, it would seem our data stored on SSD is unavailable using ordinary means (take the physical drive and plug it into a reader to see what’s there). This makes for a good basic security barrier to eliminate the casual threat, but also makes forensic recovery and eDiscovery significantly harder. Second, the highly dedicated and skilled attacker will find a way to recover what’s left on the drive through extraordinary means. It also means that forensic recovery, while possible, just got a lot more expensive.
Ultimately, the sky is not falling and most of us can still sleep at night (if we ever really did with all that worrying about data we do). SSDs give us speed, power savings, and all the other benefits we’ve come to expect; but they also give threats a new barrier to entry on getting at our data. They also give forensic shops a barrier to entry in dealing with them. Companies using forensic recovery services will have to make sure their vendors know how to deal with the technology, how it behaves, what to expect, and why it’s happening. Simply buying a screwdriver and a software dongle are no longer enough, and I don’t believe that’s a bad thing when my data’s involved.
By: Bradley J. Bartram is the Vice President of Information Technology and CTO for DIGITS LLC, one of the premier providers of forensic services in New York and the surrounding states. Brad has been employed in various capacities in Information Technology since 1996 and currently holds certifications as a Certified Electronic Evidence Collection Specialist (CEECS) and Certified Forensic Computer Examiner (CFCE). He blogs concerning information security, digital forensics, and eDiscovery matters.
