Recovering Evidence from SSD Drives in 2014

articles.forensicfocus.com

70 points·ssclafani··6 comments

The paragraph about reading from flash chips directly reminded me of http://www.flash-extractor.com/ which is mostly for USB drives, but claims to work on some SSDs too. The forums there are full of posts with rather cryptic terminology about the on-chip layouts used by various controllers.

...and is it just me or do the majority of information and sites on data recovery seem to be from Russia?

The Americans who do this most likely work for "the government" and don't blog as much.

Actually there are americans working on digital forensics that are open about their work. Check forensicswiki, Simson Garfinkel, Golden Richard III, and the DFRWS community in general.

Note: data recovery is usually considered a subset of digital forensics.

>...and is it just me or do the majority of information and sites on data recovery seem to be from Russia?

It's not just you. There is a lot of really interesting data recovery tech that you can only find in Russia/China/India.

I don't really have any good ideas as to why this might be.

I wonder if there is an opportunity for the sellers of these SSDs to use privacy as a USP. "With this SSD, once you delete data it is gone and not even the NSA can find it again"

That's basically the pitch of data-at-rest encryption that the entire storage industry is working on in some form.

Reply on news.ycombinator.com