Hacker News new | ask | show | jobs
by gvb 5583 days ago
The whole (rather breathless) point of the article is that SSDs erases the blocks quite rapidly. It isn't that the old blocks are still laying around but the researchers did not know how to access them, it is that (a) they are erased rapidly under normal conditions and (b) they are erased even when they researchers used a "write blocker" mechanism[1]. IOW, they (the article's author, anyway) were apparently surprised to find that the SDD garbage collected autonomously and regardless of the "write blocker" mechanism).

The (a) case is likely OSes using the "trim" command and the (b) cases are inherent in how SSD firmware works (by necessity). WRT the (b) case, SSDs have to garbage collect. Their write speed, and thus user satisfaction, is dependent on it keeping a large number of erased blocks ready to be written to.

[1] http://www.forensicswiki.org/wiki/Write_Blockers - apparently simply a "man in the middle" hardware that filters out write commands, lets through read commands.

Obviously, there is no reasonable way for a SDD to even know that a "write blocker" is attached, so it is not surprising (to me) that the SDD garbage collects with it attached.

1 comments

The whole (rather breathless) point of the article is that SSDs erases the blocks quite rapidly.

Yes, so the proper way to analyse an SSD is to just access what's in the flash chips directly. Such methods and equipment will probably need to be developed specifically for each SSD controller chipset. Also, investigators will need to get to an SSD sooner.