The answer to this question comes from understanding the basic operation of the SSD, then
examining the forensic implications.
The problem with SSD storage devices is that they
use flash memory chips. The problem with flash
memory chips is that they suffer two nearly fatal
1. Over time, with repeated write operations,
they wear out. Standard flash lifetimes are up to
100,000 cycles per block before failure is possible.1
2. All write operations to the flash memory chips
must occur on a block by block basis. For practical
purposes, it is impossible to overwrite new data in
place of old data. (A block within a flash memory
chip is similar to, but not the same as, a sector of
information.) 2 As a result, for highest SSD performance, it is imperative that we always have a fresh
supply of empty SSD blocks, ready to be written
with new data. It would take too much time to
always have to clear a block before we wrote (or
overwrote) new data into that block.
It is easy to illustrate these problems.
Consider a standard File Allocation Table, generic
to any operating system: it is frequently rewritten
and updated as files are changed on a storage device.
If files on our hypothetical SSD were accessed
and changed 100,000 times in a single day (which
is easily possible), then, in the absence of corrective technology, the SSD could experience failures
soon thereafter. The rewritten sector of FAT data,
changed each time the file was updated, would be
particularly vulnerable to failure.
The second problem requires us to write a full
block of data every time we want to write anything
to the SSD.
SSD Implementations Solve the Problems
The common Etch-A-Sketch TM is a helpful illustration for understanding these problems!
Using an Etch-A-Sketch is a lot like using flash
memory (Figure 5).
1. Before writing a new image to the toy, it
must be shaken (or erased). The resulting image
is a blank silver screen. The blank screen represents our flash memory chip, when it is ready to
receive new block information (Figure 6).
2. It is then possible to write a new image to the
toy. Remember that the image is an allegory for
anything at all—an image, a file, an excel spread-sheet, a FAT table, an e-mail. This represents the
Figure 5: Original Etch-A-Sketch image
Figure 6: Blank Etch-A-Sketch
way in which we’ve written new information to a
block in our flash device (Figure 7).
3. The picture on the Etch-A-Sketch is readable
at any time just by looking at it. But if you want
to overwrite or change the picture in any way, you
have to shake it and start with a blank slate. The
constant image shows us that we can view, or read,
our data anytime we want.
Using an Etch-A-Sketch, it’s easy to understand
how we have to shake the screen back to a cleared
state every time we want to write a new image.
With our Etch-A-Sketch as our fundamental
illustration, it’s time to introduce a new concept
within our flash memory understanding—the concept is Wear Leveling.
Every time we want to modify a block of information on our flash device, we have to make a copy
of that information, then clear the original block,
then rewrite the block with the modified information. That’s a lot of movement of data, just to
change a few bits!
In order to speed this process, it would be helpful to always have a fresh supply of cleared blocks,