For years, people have been trying to cover their tracks by deleting incriminating files from their computers. The recovery of this kind of evidence from magnetic drives has been the bread and butter of digital forensics for years, but those days may very well be coming to an end.
The traditional magnetic drives that we are accustomed to using are being replaced more and more by solid-state drives (SSDs). Traditionally, magnetic drives afford examiners the ability to recover significant amounts of user-deleted data. As we’ll see, SSDs store data in a completely different way than their magnetic cousins, and, as a result, these drives don’t afford forensic examiners the same opportunities when it comes to deleted file recovery and acquisition verification.
To get a true understanding of the challenges presented by SSD technology for forensic recovery, we need to understand how traditional hard drives function.