Potential difficulties during investigations due to solid state drive (SSD) technology

James Cox; Peter Bednar

doi:10.1007/978-3-319-90503-7_7

Potential difficulties during investigations due to solid state drive (SSD) technology

James Cox^*
, Peter Bednar

^*Corresponding author for this work

Lund University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

This paper discusses potential complications for Forensic Investigations due to the spread of Solid State Disc (SSD) technologies and influence of socio-technical factors. The discussion is drawing upon a study based on interviews with an experienced Forensic Investigator from Hampshire Constabularies Hi-Tech Crime Unit (HTCU), located in the United Kingdom. The goal of this study was to identify examples of what experienced forensic investigators believe the biggest drawbacks with examining SSDs are. Background case studies have been made in assistance to identify specific characteristics and features that may impact forensic investigations. Key characteristics include that SSD features may pose a threat as potential evidence can be rendered inaccessible; possibly impacting the case or project negatively. The main themes discussed in this paper are related to: Hardware-based encryption, Garbage Collection (GC), the TRIM command, Controller technology, SSD Interfaces, and SSD User needs. Socio-technical influences were acknowledged during the interviews with the Investigator, showing uncertainty to alternative Forensic methods. These themes have been scrutinized to identify how they impact and limit investigations.

Original language	English
Title of host publication	Organizing the Digital World
Subtitle of host publication	IT for Individuals, Communities and Societies
Editors	Federico Cabitza, Carlo Batini, Massimo Magni
Publisher	Springer Cham
Pages	75-91
Number of pages	17
Edition	1st
ISBN (Electronic)	9783319905037
ISBN (Print)	9783319905020
DOIs	https://doi.org/10.1007/978-3-319-90503-7_7 https://doi.org/10.1007/978-3-319-90503-7
Publication status	Published - 21 Aug 2019

Publication series

Name	Lecture Notes in Information Systems and Organisation
Volume	28
ISSN (Print)	2195-4968
ISSN (Electronic)	2195-4976

Keywords

Digital forensic investigations
socio-technical
solid state drives (SSDs)

Access to Document

https://link.springer.com/book/10.1007/978-3-319-90503-7

Cite this

Cox, J., & Bednar, P. (2019). Potential difficulties during investigations due to solid state drive (SSD) technology. In F. Cabitza, C. Batini, & M. Magni (Eds.), Organizing the Digital World: IT for Individuals, Communities and Societies (1st ed., pp. 75-91). (Lecture Notes in Information Systems and Organisation; Vol. 28). Springer Cham. https://doi.org/10.1007/978-3-319-90503-7_7, https://doi.org/10.1007/978-3-319-90503-7

@inproceedings{d2c97bd5343f4c3aa8e3da42eaed5360,

title = "Potential difficulties during investigations due to solid state drive (SSD) technology",

abstract = "This paper discusses potential complications for Forensic Investigations due to the spread of Solid State Disc (SSD) technologies and influence of socio-technical factors. The discussion is drawing upon a study based on interviews with an experienced Forensic Investigator from Hampshire Constabularies Hi-Tech Crime Unit (HTCU), located in the United Kingdom. The goal of this study was to identify examples of what experienced forensic investigators believe the biggest drawbacks with examining SSDs are. Background case studies have been made in assistance to identify specific characteristics and features that may impact forensic investigations. Key characteristics include that SSD features may pose a threat as potential evidence can be rendered inaccessible; possibly impacting the case or project negatively. The main themes discussed in this paper are related to: Hardware-based encryption, Garbage Collection (GC), the TRIM command, Controller technology, SSD Interfaces, and SSD User needs. Socio-technical influences were acknowledged during the interviews with the Investigator, showing uncertainty to alternative Forensic methods. These themes have been scrutinized to identify how they impact and limit investigations.",

keywords = "Digital forensic investigations, socio-technical, solid state drives (SSDs)",

author = "James Cox and Peter Bednar",

year = "2019",

month = aug,

day = "21",

doi = "10.1007/978-3-319-90503-7\_7",

language = "English",

isbn = "9783319905020",

series = "Lecture Notes in Information Systems and Organisation",

publisher = "Springer Cham",

pages = "75--91",

editor = "Federico Cabitza and Carlo Batini and Massimo Magni",

booktitle = "Organizing the Digital World",

edition = "1st",

}

Cox, J & Bednar, P 2019, Potential difficulties during investigations due to solid state drive (SSD) technology. in F Cabitza, C Batini & M Magni (eds), Organizing the Digital World: IT for Individuals, Communities and Societies. 1st edn, Lecture Notes in Information Systems and Organisation, vol. 28, Springer Cham, pp. 75-91. https://doi.org/10.1007/978-3-319-90503-7_7, https://doi.org/10.1007/978-3-319-90503-7

Potential difficulties during investigations due to solid state drive (SSD) technology. / Cox, James; Bednar, Peter.
Organizing the Digital World: IT for Individuals, Communities and Societies. ed. / Federico Cabitza; Carlo Batini; Massimo Magni. 1st. ed. Springer Cham, 2019. p. 75-91 (Lecture Notes in Information Systems and Organisation; Vol. 28).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Potential difficulties during investigations due to solid state drive (SSD) technology

AU - Cox, James

AU - Bednar, Peter

PY - 2019/8/21

Y1 - 2019/8/21

N2 - This paper discusses potential complications for Forensic Investigations due to the spread of Solid State Disc (SSD) technologies and influence of socio-technical factors. The discussion is drawing upon a study based on interviews with an experienced Forensic Investigator from Hampshire Constabularies Hi-Tech Crime Unit (HTCU), located in the United Kingdom. The goal of this study was to identify examples of what experienced forensic investigators believe the biggest drawbacks with examining SSDs are. Background case studies have been made in assistance to identify specific characteristics and features that may impact forensic investigations. Key characteristics include that SSD features may pose a threat as potential evidence can be rendered inaccessible; possibly impacting the case or project negatively. The main themes discussed in this paper are related to: Hardware-based encryption, Garbage Collection (GC), the TRIM command, Controller technology, SSD Interfaces, and SSD User needs. Socio-technical influences were acknowledged during the interviews with the Investigator, showing uncertainty to alternative Forensic methods. These themes have been scrutinized to identify how they impact and limit investigations.

AB - This paper discusses potential complications for Forensic Investigations due to the spread of Solid State Disc (SSD) technologies and influence of socio-technical factors. The discussion is drawing upon a study based on interviews with an experienced Forensic Investigator from Hampshire Constabularies Hi-Tech Crime Unit (HTCU), located in the United Kingdom. The goal of this study was to identify examples of what experienced forensic investigators believe the biggest drawbacks with examining SSDs are. Background case studies have been made in assistance to identify specific characteristics and features that may impact forensic investigations. Key characteristics include that SSD features may pose a threat as potential evidence can be rendered inaccessible; possibly impacting the case or project negatively. The main themes discussed in this paper are related to: Hardware-based encryption, Garbage Collection (GC), the TRIM command, Controller technology, SSD Interfaces, and SSD User needs. Socio-technical influences were acknowledged during the interviews with the Investigator, showing uncertainty to alternative Forensic methods. These themes have been scrutinized to identify how they impact and limit investigations.

KW - Digital forensic investigations

KW - socio-technical

KW - solid state drives (SSDs)

UR - https://www.scopus.com/pages/publications/85052211670

U2 - 10.1007/978-3-319-90503-7_7

DO - 10.1007/978-3-319-90503-7_7

M3 - Conference contribution

AN - SCOPUS:85052211670

SN - 9783319905020

T3 - Lecture Notes in Information Systems and Organisation

SP - 75

EP - 91

BT - Organizing the Digital World

A2 - Cabitza, Federico

A2 - Batini, Carlo

A2 - Magni, Massimo

PB - Springer Cham

ER -

Cox J, Bednar P. Potential difficulties during investigations due to solid state drive (SSD) technology. In Cabitza F, Batini C, Magni M, editors, Organizing the Digital World: IT for Individuals, Communities and Societies. 1st ed. Springer Cham. 2019. p. 75-91. (Lecture Notes in Information Systems and Organisation). Epub 2018 Aug 21. doi: 10.1007/978-3-319-90503-7_7, 10.1007/978-3-319-90503-7

Potential difficulties during investigations due to solid state drive (SSD) technology

Abstract

Publication series

Keywords

Access to Document

Fingerprint

Cite this