Advanced

Potential difficulties during investigations due to solid state drive (SSD) technology

Cox, James and Bednar, Peter LU (2018) In Lecture Notes in Information Systems and Organisation 28. p.75-91
Abstract

This paper discusses potential complications for Forensic Investigations due to the spread of Solid State Disc (SSD) technologies and influence of socio-technical factors. The discussion is drawing upon a study based on interviews with an experienced Forensic Investigator from Hampshire Constabularies Hi-Tech Crime Unit (HTCU), located in the United Kingdom. The goal of this study was to identify examples of what experienced forensic investigators believe the biggest drawbacks with examining SSDs are. Background case studies have been made in assistance to identify specific characteristics and features that may impact forensic investigations. Key characteristics include that SSD features may pose a threat as potential evidence can be... (More)

This paper discusses potential complications for Forensic Investigations due to the spread of Solid State Disc (SSD) technologies and influence of socio-technical factors. The discussion is drawing upon a study based on interviews with an experienced Forensic Investigator from Hampshire Constabularies Hi-Tech Crime Unit (HTCU), located in the United Kingdom. The goal of this study was to identify examples of what experienced forensic investigators believe the biggest drawbacks with examining SSDs are. Background case studies have been made in assistance to identify specific characteristics and features that may impact forensic investigations. Key characteristics include that SSD features may pose a threat as potential evidence can be rendered inaccessible; possibly impacting the case or project negatively. The main themes discussed in this paper are related to: Hardware-based encryption, Garbage Collection (GC), the TRIM command, Controller technology, SSD Interfaces, and SSD User needs. Socio-technical influences were acknowledged during the interviews with the Investigator, showing uncertainty to alternative Forensic methods. These themes have been scrutinized to identify how they impact and limit investigations.

(Less)
Please use this url to cite or link to this publication:
author
organization
publishing date
type
Chapter in Book/Report/Conference proceeding
publication status
published
subject
keywords
Digital forensic investigations, Socio-technical, Solid state drives (SSDs)
in
Lecture Notes in Information Systems and Organisation
volume
28
pages
17 pages
publisher
Springer Heidelberg
external identifiers
  • scopus:85052211670
DOI
10.1007/978-3-319-90503-7_7
language
English
LU publication?
yes
id
a3ede6b0-ed2d-45c6-b29d-ffd509a063a2
date added to LUP
2018-09-14 13:03:25
date last changed
2018-09-16 04:57:22
@inbook{a3ede6b0-ed2d-45c6-b29d-ffd509a063a2,
  abstract     = {<p>This paper discusses potential complications for Forensic Investigations due to the spread of Solid State Disc (SSD) technologies and influence of socio-technical factors. The discussion is drawing upon a study based on interviews with an experienced Forensic Investigator from Hampshire Constabularies Hi-Tech Crime Unit (HTCU), located in the United Kingdom. The goal of this study was to identify examples of what experienced forensic investigators believe the biggest drawbacks with examining SSDs are. Background case studies have been made in assistance to identify specific characteristics and features that may impact forensic investigations. Key characteristics include that SSD features may pose a threat as potential evidence can be rendered inaccessible; possibly impacting the case or project negatively. The main themes discussed in this paper are related to: Hardware-based encryption, Garbage Collection (GC), the TRIM command, Controller technology, SSD Interfaces, and SSD User needs. Socio-technical influences were acknowledged during the interviews with the Investigator, showing uncertainty to alternative Forensic methods. These themes have been scrutinized to identify how they impact and limit investigations.</p>},
  author       = {Cox, James and Bednar, Peter},
  keyword      = {Digital forensic investigations,Socio-technical,Solid state drives (SSDs)},
  language     = {eng},
  month        = {08},
  pages        = {75--91},
  publisher    = {Springer Heidelberg},
  series       = {Lecture Notes in Information Systems and Organisation},
  title        = {Potential difficulties during investigations due to solid state drive (SSD) technology},
  url          = {http://dx.doi.org/10.1007/978-3-319-90503-7_7},
  volume       = {28},
  year         = {2018},
}