TRIM, Wear Levelling and Garbage Collection on Solid State Drives: A Prediction Model for Forensic Investigators

A fundamental requirement for evidence in any civil or criminal case is that nothing should be done to the evidence that changes it in any way. This may not always be possible and can be acceptable provided the changes can be justified. A forensic investigator who seizes digital evidence can normally secure that evidence and show that what is presented during a trial is identical to what was seized. In the case of solid state hard drives, there are 3 technologies that may alter the evidence: TRIM, Wear Levelling and Garbage Collection. All three of these moves or deletes data from the drive leading to evidence that is in a different state from when it was seized. This research examines these 3 processes and offers a guideline for predicting when they may be implemented, the effect of these processes and how to explain to a court what has occurred.