4 ms·
Hi, I'm the author of the first reference cited by this article, and the coiner of the term 'self-corrosion' for this phenomenon. First of all, thank you to th
by random_number 12y ago
Hi,
I'm the author of the first reference cited by this article, and the coiner of the term 'self-corrosion' for this phenomenon. First of all, thank you to the author of the headline article for their interesting article and for citing our research.
I'd say our main findings were a little bit different to what is described in the article, though I'd agree with most of what was written there.
We discovered that SSD drives can wipe themselves (with their own GC) even in the absence of TRIM commands and despite the use of forensic write-blockers that block both writes and trims being sent on the ATA/SATA bus. To my mind, that's what is really shocking - you get this phenomenon even when the very best forensic tools are used and even on OS's that aren't using TRIM. (My coauthor was a professional forensic investigator armed with professional equipment).
For example, imagine if you had some data on your disk that was fragmented all over the disk. If the disk has a garbage collector that wants to consolidate flash sectors so it can erase the leftover space after consolidation (e.g. to improve performance), then you're going to get deleted data being purged without any TRIM command being involved after the consolidate/erase operation.
If I remember right (it's been a few years), some firmwares also detect fast-formatting operations in OS's that don't support TRIM and use that as a clue to trigger automatic GC. That was the really stunning one for us. A fast format by the user led to the disk wiping itself just minutes later under forensic conditions.
Of course this sounds great for privacy, self-wiping and so on, but the problem is that it could look like this accidental wiping was an intentional attempt to destroy evidence (e.g. manual wipe, logic bomb or something). That's where things get tricky.
It looks like the link isn't working, here's a working link:
http://graemebell.net/publications//upload/bellbodd2010-preprint.pdf http://graemebell.net/publications//upload/bellbodd2010-prep...
or
http://researchrepository.murdoch.edu.au/3714/1/solid_state_drives.pdf http://researchrepository.murdoch.edu.au/3714/1/solid_state_...
That paper was written for any educated person to understand, not just forensic experts, so I hope you enjoy it if you do take a look. We talk about both the technical and legal side of things in the paper.
Thanks for reading, and I'll check in on this comment later in case anyone has questions.
- random_number 12y agoOne other thing, if you want to try this out at home, all the code we wrote for our experiment was given at the end of the PDF paper as open source scripts, feel welcome to try it on more modern disks/OS and tell us what happens :-)
- wmf 12y agoI strongly suspect what you saw in this paper was Samsung's[1] auto-trim (people often use inaccurate terms like "idle garbage collection") that reads the NTFS allocation bitmap and trims free space, a feature that was only included on a few SSDs because it is a potentially unsafe rampant layering violation. In the history of SSDs, almost none have auto-trim, so the results from this paper are highly non-representative of SSDs in general. [1] Note that the Corsair SSD used in this paper is rebranded from Samsung.
- random_number 12y ago"I strongly suspect what you saw in this paper was Samsung's[1] auto-trim " Yes, that was the reason for picking that drive (the research budget for the project was a mere $500!), since I was pretty confident the effect might show up from it. However, it was a lucky guess that it would show up in the presence of a write blocker and in the time frame of a forensic investigation (normally the first thing that happens is they quickly copy the disk), since those are unusual constraints. I think I prefer to call the technology the same as the manufacturer's name: idle garbage collection - since TRIM has a clear meaning in this context, and the drive is not automatically generating TRIM commands and it doesn't behave exactly as though the O/S had issued them either (e.g. most but not all gets wiped). Hope we can agree to disagree on that one! Thanks for your comment
- wmf 12y agoMy problem with the terminology is that garbage collection already has a well-defined but different meaning in SSDs.