SSDs and some of their uses
TipTipA solid-state drive (SSD) is a data storage device that uses solid-state memory to persist data in the same way as a hard disk drive—meaning the data is retained when power is removed. A solid-state drive, or SSD, is essentially memory that is being used to act as hard drive storage. From the application’s viewpoint, an SSD looks and acts just like a hard drive, albeit usually a relatively small one. Solid-state drives have definite advantages and disadvantages. Having no mechanical parts, they are significantly faster than hard drives. The negatives are that they are much more expensive per GB and don’t have the same capacity as a typical hard drive. SSD stands for solid state drive. The solid state contrasts with a hard disk drive (HDD), which consists of components with hollow and moving states. It also means that when an SSD reads or writes information or data, it does not require moving parts. SSD is flash technology-based storage as it does not require power. Hence, it is also called as nonvolatile flash memory. If it uses “Not AND” or “Negated AND” logic gates, the full name of the memory chip becomes nonvolatile NAND flash memory. If your application relies heavily upon a relatively small amount of data or files, then utilizing SSD might be effective. To make sure you’re not wasting your time and money, you should discuss this with the vendor before making a financial commitment.NAND logic gates are generally applied for RAM, USB memory, and SSDs. Flash storage is in the realm of semiconductor memory. It captures information or data in an array of columns and rows that consist of a semiconductor cell across every intersection.
The TRIM command improves garbage collection. TRIM is an attribute of the ATA Data Set Management Command. The TRIM function improves compatibility, endurance, and performance by allowing the drive to do garbage collection in the background. This collection eliminates blocks of data, such as deleted files. While the TRIM command improves performance: it does not reliably destroy data. There are two issues with flash technology. One of them is that memory cells do not like to be flashed too frequently because after many flash cycles (erasing), the transistor gate becomes worn out and eventually has to be broken down. This is also called the wear level. Another issue is that when the SSD does sequential writing for new data it has to follow the process of erasing and then writing. This leads to slower performance. Sometime, it may be slower than a high end HDD.To resolve these issues, single level cell (SLC) has been adopted for many enterprise storage applications. SLC only stores a single bit, which is either a “1” or “0” bit. In contrast, multilevel cell (MLC) will accommodate two bits, which are “00”, “01”, “10”, and “11”. In comparison with MLC, SLC has ten times the endurance (flash) of MLC but it comes with a high cost. There is another type of flash that Samsung adopted, called is triple level cell (TLC). It has three bits. A ‘sector by sector overwrite’ behaves very differently on an SSD vs. a magnetic drive, and does not reliably destroy all data. Also, electronically shredding a file (overwriting the file’s data before deleting it, which we will discuss shortly) is not effective. Strictly speaking, SLC, MLC, or TLC doesn’t last fever but they are protected by a flash controller that is always built into an SSD. It manages error correction, wear leveling, and data distribution so that all data written is spread evenly across all physical blocks of the SSD. Data on SSD drives that are not physically damaged may be securely removed via ATA Secure Erase. SanDisk provides the following details: “When the relevant secure erase command is executed on the SanDisk SSD, all blocks in the physical address space, regardless of whether they are currently or were previously allocated to the logical space, are completely erased (the “logical to physical mapping table” is also erased). Additionally, a new encryption key is generated and the old key is discarded. This erase operation does not overwrite the blocks like an HDD write or format command would. Data is written to flash on a page-level and a page must be completely erased before it can be written to again. Unlike HDDs, which may leave remnants of data in regions between tracks, an erased flash cell is restored to the same content it contained at the time it was manufactured. As in the case with an HDD, physical blocks that have been marked “bad” may still contain remnant user data. There is no way to access these blocks to overwrite them, and secure erase makes no attempt to do so. Because the secure erase operation also regenerates the internal encryption key, it is not possible to decrypt the data, even if it were accessible”. Solid-state drives (SSDs) are becoming more typical in investigations. If you have not run into one yet, you will. They are mostly found in netbooks, which are popular due to their size and cost. But with the price for SSDs dropping and the number of suppliers increasing, it is possible that entire databases are going to be running in-memory. In December 2009, Seagate released the Pulsar, a 2.5-inch on-server drive. Other vendors that entered the SSD enterprise solutions market before Seagate include STEC with its fiber-channel interface ZeusIOPS product and Intel with its X25 product. In addition, Western Digital is planning to move into the enterprise SSD space. Many drive manufactures, both large and small, are coming out with new techniques to improve the read and write performances of SSDs, making them more attractive. The two valid options for destroying data on SSD drives are ATA secure erase and destruction. Destruction is the best method for SSD drives that are physically damaged.
When examining netbooks, there are some items to keep in mind. First, not all live CDs will boot on an Eee PC. The investigator may have to try several different disks in order to get the machine to boot. In shops where all acquisitions are done by actually removing the hard drive from the machine, depending on the model, it may take longer to disassemble the netbook and remove the drive than it does to actually image the drive. Reassembly can also require a bit of time. The read accuracy decreases after a certain number of reads possibly making carving difficult. The internal data structure is not well understood and may contain hidden data useful in forensics. A SSD is a combination of flash memory (EEPROM) and DRAM. Degaussing (destroying data via a strong magnetic field, which we will discuss shortly) has no effect on SSDs. While physical disks have physical blocks (eg, Block 1 is on a specific physical location on a magnetic disk), blocks on SSDs are logical and are mapped to physical blocks. Also, SSDs do not overwrite blocks that contain data; the device will instead write data to an unused block and mark the previous block unallocated. How do Flash and SSD Work? SSD use NAND flash memory chips. These chips have millions of addressable “cells” that are designed to trap electrons—think of them as tiny bottles (in geek-speak, floating gates) that have an inlet with a valve transistor and a way to measure how much charge is contained in them. All of the cells start off drained of charge. When a controller wants to load up the cell with data it opens the inlet transistor to let a charge enter the cell. The charge remains there in an almost leak-proof state. The result is that cells with no charge can denote a one state and those with a charge denote a 0-state.
References
Domain 2: Asset Security (Protecting Security of Assets)
