Live forensics method for acquisition on the Solid State Drive (SSD) NVMe TRIM function
Abstract views: 95

Live forensics method for acquisition on the Solid State Drive (SSD) NVMe TRIM function

Wisnu Pranoto, Imam RIadi, Yudi Prayudi

Abstract

SSD currently has a new storage media technology namely Solid State Drive Non-volatile Memory Express (SSD NVMe). In addition, SSD has a feature called TRIM. The TRIM feature allows the operating system to tell SSDs which blocks are not used. TRIM removes blocks that have been marked for removal by the operating system. However, the TRIM function has a negative effect for the digital forensics specifically related to data recovery. This study aimed to compare the TRIM disable and enable functions to determine the ability of forensics tools and recovery tools to restore digital evidence on the NVMe SSD TRIM function. The operating system used in this study was Windows 10 professional with NTFS file system. Typically, acquisition is conducted by using traditional or static techniques. Therefore, there was a need of a technique to acquire SSD by using the live forensics method without shutting down the running operating system. The live forensics method was applied to acquire SSD NVMe directly to the TRIM disable and enable functions. The tools used for live acquisition and recovery were FTK Imager Portable. The inspection and analysis phases used Sleutkit Autopsy and Belkasoft Evidence Center. This research found that in the recovery process of TRIM disabled and enabled, TRIM disabled could find evidence while maintaining the integrity of evidence. It was indicated by the same hash value of the original file and the recovery file. Conversely, when TRIM is enabled, the files were damaged and could not be recovered. The files were also not identical to the original so the integrity of evidence was not guaranteed.

Keywords

Solid State Drive NVMe, Digital Evidence, TRIM, Live Forensics

References

[1] Dwi, “Laporan Dwi Bulan I 2014,” Incid. Monit. Rep., pp. 1–9, 2018.

[2] M. Nuh Al-Azhar, Digital Forensic Practical Guildelines for Computer Investigation, no. c. 2012.

[3] I. Riadi, R. Umar, and I. M. Nasrulloh, “Analisis Forensik Digital Pada Frozen Solid State Drive Dengan Metode National Institute of Justice (NIJ),” Elinvo (Electronics, Informatics, Vocat. Educ., vol. 3, no. 1, pp. 70–82, Jul. 2018.

[4] R. A. Ramadhan, Y. Prayudi, and B. Sugiantoro, “Implementasi dan Analisis Forensika Digital Pada Fitur Trim Solid State Drive (SSD),” 2016.

[5] B. Nikkel, “NVM express drives and digital forensics,” Digit. Investig., vol. 16, pp. 38–45, 2016.

[6] Q. Xu et al., “Performance Analysis of NVMe SSDs and their Implication on Real World Databases,” SYSTOR 2015 - Proc. 8th ACM Int. Syst. Storage Conf., 2015.

[7] R. Hubbard, “Forensics Analysis of Solid State Drive ( SSD ),” pp. 1–11, 2016.

[8] F. Geier, “The differences between SSD and HDD technology regarding forensic investigations,” p. 67, 2015.

[9] R. K. Chaurasia and P. Sharma, “Solid State Drive (SSD) Forensics Analysis : A New Challenge,” Int. J. Sci. Res. Comput. Sci. Eng. Inf. Technol. © 2017 IJSRCSEIT, vol. 6, no. 2, pp. 1081–1085, 2017.

[10] Statista, “Shipments of Hard and Solid State Disk (HDD/SSD) Drives Worldwide From 2015 to 2021.” [Online]. Available: https://www.statista.com/statistics/285474/hdds-and-ssds-in-pcs-global-shipments-2012-2017/.

[11] M. N. Al-Azhar, “The Essentials of Digital Forensic,” 2016.

[12] Y. Prayudi, “Problema dan Solusi Digital Chain of Custody,” Senasti - Semin. Nas. Sains dan Teknol. Inf., no. 2011, 2014.

[13] Soni, D. Sudyana, Y. Prayudi, H. Mukhtar, and B. Sugiantoro, “Server Virtualization Acquisition Using Live Forensics Method,” Adv. Eng. Res., vol. 190, pp. 18–23, 2019.

[14] D. Sudyana and N. Lizarti, “Digital Evidence Acquisition System on IAAS Cloud Computing Model using Live Forensic Method,” Sci. J. Informatics, vol. 6, no. 1, pp. 125–137, 2019.

[15] I. Riadi and M. E. Rauli, “Live forensics analysis of line app on proprietary operating system,” Kinet. Game Technol. Inf. Syst. Comput. Network, Comput. Electron. Control, vol. 4, no. 4, pp. 305–314, 2019.

[16] J. Arulraj and A. Pavlo, “How to Build a Non-Volatile Memory Database Management System,” Proc. ACM SIGMOD Int. Conf. Manag. Data, vol. Part F1277, pp. 1753–1758, 2017.

[17] M. Rafique and M. N. A. Khan, “Exploring Static and Live Digital Forensics: Methods, Practices and Tools,” Int. J. Sci. Eng. Res., vol. 4, no. 10, pp. 1048–1056, 2013.

[18] A. Nisbet, S. Lawrence, and M. Ruff, “A Forensic Analysis and Comparison of Solid State Drive Data Retention With Trim Enabled File Systems,” Aust. Digit. Forensics Conf., p. 10, 2013.

[19] A. Faiz and R. Imam, “Forensic Analysis of ‘Frozen’ Hard Drive Using Deep Freeze Method,” no. March, 2017.

[20] A. Hadi and S. Riadi, Imam, “Forensik Bukti Digital Pada Solid State Drive ( SSD ) NVMe Menggunakan Metode National Institute Standards and Technology ( NIST ),” pp. 551–558, 2019.

[21] D. S. Yudhistira, “Metode Live Forensics Untuk Analisis Random Access Memory Pada Perangkat Laptop,” 2018.

[22] S. Rahman and M. N. A. Khan, “Review of Live Forensic Analysis Techniques,” Int. J. Hybrid Inf. Technol., vol. 8, no. 2, pp. 379–388, 2015.

[23] B. S. Nasional, “Teknologi Informasi – Teknik Keamanan – Pedoman Identifikasi, Pengumpulan Akuisisi, dan Preservasi Bukti Digital,” in SNI 27037:2014, Jakarta, 2014.

[24] D. Jeong and S. Lee, “Forensic signature for tracking storage devices: Analysis of UEFI firmware image, disk signature and windows artifacts,” Digit. Investig., vol. 29, pp. 21–27, 2019.

[25] K. Gary, “File Signature.” [Online]. Available: https://www.garykessler.net/library/file_sigs.html.

[26] Y. Gubanov and O. Afonin, “Recovering Evidence from SSD Drives: Understanding TRIM, Garbage Collection, and Exclusions,” 2014.

Refbacks

  • There are currently no refbacks.

Indexed by: 

    

Referencing Software:

Checked by:

Supervised by:

Statistic:

View My Stats


Creative Commons License Kinetik : Game Technology, Information System, Computer Network, Computing, Electronics, and Control by http://kinetik.umm.ac.id is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.