"I strongly suspect what you saw in this paper was Samsung's[1] auto-trim " Yes, that was the reason for picking that drive (the research budget for the projec

"I strongly suspect what you saw in this paper was Samsung's[1] auto-trim " Yes, that was the reason for picking that drive (the research budget for the project was a mere $500!), since I was pretty confident the effect might show up from it. However, it was a lucky guess that it would show up in the presence of a write blocker and in the time frame of a forensic investigation (normally the first thing that happens is they quickly copy the disk), since those are unusual constraints. I think I prefer to call the technology the same as the manufacturer's name: idle garbage collection - since TRIM has a clear meaning in this context, and the drive is not automatically generating TRIM commands and it doesn't behave exactly as though the O/S had issued them either (e.g. most but not all gets wiped). Hope we can agree to disagree on that one! Thanks for your comment