The differences between SSD and HDD technology regarding forensic investigations
Independent thesis Basic level (degree of Bachelor), 10 credits / 15 HE creditsStudent thesis
In the past years solid state disks have developed drastically and are now gaining increased popularity compared to conventional hard drives. While hard disk drives work predictable, transparent SSD routines work in the background without the user’s knowledge.
This work describes the changes to the everyday life for forensic specialists; a forensic investigation includes data recovery and the gathering of a digital image of each acquired memory that provides proof of integrity through a checksum. Due to the internal routines, which cannot be stopped, checksums are falsified. Therefore the images cannot prove integrity of evidence anymore. The report proves the inconsistence of checksums of SSD and shows the differences in data recovery through high recovery rates on hard disk drives while SSD drives scored no recovery or very poor rates.
Place, publisher, year, edition, pages
2015. , 60 p.
SSD, HHD, Data Recovery, Forensics, Flash Memory, Solid State Disk, Hard Disk Drive, TRIM, Garbage collection, Wear leveling, NAND, SandForce
IdentifiersURN: urn:nbn:se:lnu:diva-44921OAI: oai:DiVA.org:lnu-44921DiVA: diva2:824922
Subject / course
Network Security Programme, 180 credits
Flygt, Ola, Lecturer
Hagelbäck, Johan, Senior Lecturer