Evidence Verification Complications with Solid-State Drives

Solid-state drives operate on a combination of technologies that create a barrier between the physical data being written and the digital forensics investigator. This barrier prevents the application of evidence verification methods developed for magnetic disk drives because the barrier prevents the investigator from directly controlling and therefore verifying that the underlying physical data has not been manipulated. The purpose of this research is to identify a period of inactivity where the underlying physical data is not being manipulated by wear-leveling or garbage-collection routines such that evidence can be reliably verified with existing hashing algorithms. An experiment is conducted on Samsung drives. The limitation of this method is it does not enable the verification of deleted data and will be one size of solid-state drives. The results show that after an hour and a half, the solid-state drives examined will produce the same consistently until ten hours.