Browse > Article
http://dx.doi.org/10.3745/KTCCS.2015.4.9.307

Selective Recovery of the SSD TRIM Command in Digital Forensics  

Hwang, Hyun Ho (숭실대학교 컴퓨터학과)
Park, Dong Joo (숭실대학교 컴퓨터학부)
Publication Information
KIPS Transactions on Computer and Communication Systems / v.4, no.9, 2015 , pp. 307-314 More about this Journal
Abstract
Recently, market trends of auxiliary storage device HDD and SSD are interchangeable. In the future, the SSD is expected to be used more popular than HDD as an auxiliary storage device. The TRIM command technique has been proposed and used effectively due to the development of the SSD. The TRIM command techniques can be used to solve the problem of Freezing SSD that operating system cooperates with the SSD. The TRIM command techniques are performed in the idle time of the internal SSD that are actually deleted when a user deletes the data. However, in the point of view of computer forensics, the digital crime is increasing year by year due to lack of data recovery. Thus, this rate of arrest is insufficient. In this paper, I propose a solution that selectively manages data to delete based on advantage of the stability and the write speed of the TRIM command. Through experiments, It is verified by measuring the performance of the traditional method and selected method.
Keywords
Digital Forensics; Freezing Solution; Solid State Drive(SSD); TRIM Command;
Citations & Related Records
연도 인용수 순위
  • Reference
1 I. R. Jeong, D. W. Hong, and K. I. Chung, "Technologies and Trends of Digital Forensics", Electronics and Telecommunications Research Institute, Electronics and Telecommunications Trends, Vol.22, No.1, pp.97-104, 2007.
2 D. H. Kang and Y. I. Eom, "Analyses of the Characteristics of Trim Command in Solid State Drives," Proc. of the Korean Information Science Society Conference, Vol.2014, No.6, Jun., 2014.
3 H. S. Shin, "A Study on the possibility of logical data recovery of SSD consequential enable TRIM," Dongguk Graduate School of International Affairs & Information G, Aug., 2013.
4 Forensic-proof, "SSD Forensics: TRIM Command," [Internet], http://forensic-proof.com.
5 S. H. Lee, M. S. Shin, and D.-J. Park, "Preventing Deleted File Recovery using Block Permutation on NAND Flash Memory," KIISE: Database, Vol.39, No.6, Dec., 2012.
6 B. Dipert and M. Levy, "Designing with Flash Memory," Annabooks Publisher Poway, CA, USA, 1993.
7 S.-W. Lee, D.-J. Park, et al., "A log buffer-based flash translation layer using fully-associative sector translation". ACM Transactions on Embedded Computing Systems, Vol.6, No.3, Jul., 2007.
8 L.-P. Chang, T.-W. Kuo, and S.-W. Lo, "Real-Time Garbage Collection for Flash-Memory Storage Systems of Real-Time Embedded Systems," ACM Transactions on Embedded Computing Systems, Vol.3. No.4, Nov., 2004.
9 X. Wang and J. Wang, "A Wear-Leveling Algorithm for Nand Flash in Embedded System," 5th IEEE Intemational Symposium on Embedded Computing, Oct., 2008.
10 M. Saxena and M. M. Swift, "FlashVM: Virtual memory management on flash," Proc. of the 2010 USENIX Annual Technical Conf. (USENIX ATC), Jun., 2010.
11 J. Kim, H. Kim, S. Lee, and Y. Won, "FTL design for TRIM command," Proc. of 5th Int'l Workshop on Software Support for Portable Storage (IWSSPS), 2010.
12 N. Agrawal, V. Prabhakaran, T. Wobber, J. D. Davis, M. Manasse, and R. Panigrahy. "Design tradeoffs for SSD performance," Proc. of USENIX Annual Technical Conference, Jun., 2008.
13 [Internet], http://articles.forensicfocus.com/2012/10/23/whyssd-drives-destory-court-evidence-and-what-can-be-done-about-it/xhsl.