Forensic Acqusition of Solid State Storage Devices

Solid state drives (SSD) suffer from data modification issues caused by internal influences such as those caused by manufacturer implemented functionality designed to increase product life and maintain performance. The purpose of the proposed innovation is to address these issues to provide the capability of acquiring a full forensic data copy while maintaining the forensic integrity of the subject SSD. The solution will be software and firmware based and will not require physical modification of the SSD. Work will include the research and implementation of a method of leveraging manufacturer based commands in order to attain forensic level access to the flash memory. Drive controller firmware research and modification will also be performed with the goal of providing similar forensic level access as well as write-protection of the device interface. An application suite providing a user interface to the proposed functionality as well as a method of reassembling physical memory images into a standard, logical format will also be developed. The output of the reassembly software will be compatible with existing analysis tools. Completion of Phase I and Phase II efforts will result in a comprehensive suite of software and firmware tools capable of retrieving data from SSD drives in a complete and forensically sound manner without physical drive modification. Commercial applications resulting from research and development efforts include a forensic quality SSD image acquisition toolkit for lab or field use, an SSD drive and flash chip data recovery toolkit, and an SSD drive and flash chip data destruction toolkit.