Flash Forensics part II - the empire wipes back

Following up my previous Flash Forensics post, there is another paper [pdf] from some local researchers over in Perth that describes how the 'garbage collection' algorithms that purge data from the drives can wipe valuable forensic information - even when the drive was attached to a PC with a write-blocker!

It seems that the increasingly common use of flash/SSD drives is going to cause headaches for investigators and end users - not always deleting data when you want it gone, and sometimes removing data when you may want it kept (bearing in mind that forensically recovered data may be used to show innocence as well as guilt)!

This is an area of research worth keeping an eye on...

0 Response to "Flash Forensics part II - the empire wipes back"

Post a Comment

powered by Blogger | WordPress by Newwpthemes | Converted by BloggerTheme