Possibilities and modification of the forensic investigation process of solid-state drives

Frank Irmler; Knut Kröger; Reiner Creutzburg

doi:10.1117/12.2004028

7 March 2013 Possibilities and modification of the forensic investigation process of solid-state drives

Frank Irmler, Knut Kröger, Reiner Creutzburg

Proceedings Volume 8667, Multimedia Content and Mobile Devices; 866714 (2013) https://doi.org/10.1117/12.2004028
Event: IS&T/SPIE Electronic Imaging, 2013, Burlingame, California, United States

Abstract

This paper addresses the possibilities of a forensic investigation of solid-state drives. The aim of this study is to clarify information gained via a forensic analysis of these media, and explain the differences to conventional forensic examinations of hard disk drives. Within each test design a series and a variety of hard- and software were used. An interesting result is that the built-in TRIM function of the SSD has an adverse affect in a forensic investigation.

Citation Download Citation

Frank Irmler, Knut Kröger, and Reiner Creutzburg "Possibilities and modification of the forensic investigation process of solid-state drives", Proc. SPIE 8667, Multimedia Content and Mobile Devices, 866714 (7 March 2013); https://doi.org/10.1117/12.2004028

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available