SSDs are too good at dumping the garbage

Over the last couple weeks the big news with it comes to solid state drives (SSD) was how difficult it is to wipe data off those drives. In light of that there is news out now that SSDs have surprised security researchers with how effective those drives are in cleaning up garbage data.

This has organizations like police and intelligence agencies concerned because they rely on this layer of data when doing forensic work on hard drives. Having done forensic work in the past I can understand how this is worrisome because unlike current hard drives that can keep data around for an unlimited period period of time these new SSDs use algorithmic routines that surprisingly clean up the garbage data within three minutes.

After conducting a series of experiments comparing a sample Corsair 64GB SSD with a conventional Hitachi 80GB magnetic hard drive (HDD), the team found a layer cake of data recovery problems caused by the ‘garbage collection’ or purging algorithms used in SSDs to keep them at peak performance.

After examining an SSD for traces of data after it had been quick formatted, the team expected the purging routines to kick in around 30 to 60 minutes later, a process that must happen on SSDs before new data can be written to those blocks. To their surprise, this happened in only 3 minutes, after which only 1,064 out of 316,666 evidence files were recoverable from the drive.

Going a stage further, they removed the drive from the PC and connected a ‘write blocker’, a piece of hardware designed to isolate the drive and stop any purging of its contents. Incredibly, after leaving this attached for only 20 minutes, almost 19 percent of its files had been wiped for good, a process the researchers put down the ability of SSDs to initiate certain routines independent of a computer.

For comparison, on the equivalent hard drive all data was recoverable, regardless of the time elapsed, as a forensic examiner would expect.

via MacWorld