Forensic Analysis of Wear Leveling on Solid-State Media

Traditional hard drives are slowly becoming things of the past as newer technologies are constantly demanding lighter, faster, and more reliable alternatives. Solid-state media have started to permeate the market in an effort to satisfy this demand. Some tech giants have already started to use solid-state media in their products but are facing substantial price and storage capacity penalties. When it comes to performing forensic analysis on these solid-state media, the autonomous behavior of the media does not look promising as it has serious reliability issues compared to traditional media. With wear-leveling always enabled, the persistence of deleted data is always in question. The deleted data can stay on the media either partially or wholly and is dependent on various factors like the file system used on the media, capacity, manufacturer, software level TRIM functionality and also on the type of the operating system used. In this research, we analyzed different types of flash and solid-state media by filling them up with different types of files an conducted exhaustive experiments to identify the probability of recovering and file-carving once these files are deleted. The aim of this paper is to give a detailed analysis that will provide a benchmark for digital forensics investigators who are constantly troubled by the thought of analyzing solid-state media.