SSD: New Challenges for Digital Forensics

ICT changes continuously and we are used to look at IT in a slightly different way every year. Things are developed and manufactured to be smaller and faster but few changes are truly technologically revolutionary. Some changes creep up on us as they arrive under cover of previously known technology. Solid State Disks (SSD) is such a technology. The use of SSD is simple enough and for many purposes it can be used as if it was a normal hard disc but many times faster and with a very much lower power consumption. But, SSD is not an evolution of hard disc technology, it is a completely new technology which imitates the behaviour of a hard disc. There are major underpinning differences which have serious consequences for security and for digital forensic. Due to how the SSDs work it is not always certain that deleted data are purged from the disc. On the other hand SSD‟s can sometimes purge data all by themselves even if they are not connected to any interface with only the power on. This means that normal guidelines aimed at hard discs for how to preserve digital forensic evidence are not just inappropriate but could if followed result in potential evidence being lost, destroyed or deemed unvalid as evidence. This paper gives an overview of some of the principal and unexpected challenges that SSDs have brought with them for Digital Forensics investigations.