Information Security News: Self-erasing flash drives destroy court evidence

[InfoSec News <alerts () infosecnews org>]

http://www.theregister.co.uk/2011/03/01/self_destructing_flash_drives/

By Dan Goodin in San Francisco
The Register
1st March 2011

The inner workings of solid state storage devices are so fundamentally 
different from traditional hard drives that forensic investigators can 
no longer rely on current preservation techniques when admitting 
evidence stored on them in court cases, Australian scientists said in a 
research paper.

Data stored on Flash drives is often subject to a process the scientists 
called "self-corrosion," in which evidence is permanently erased or 
contaminated in ways that bits stored on magnetic-based hard drives are 
not. The alterations happen in the absence of any instructions from the 
user. The findings introduce a "grey area" into the integrity of files 
that are forensically extracted from the devices and threaten to end a 
"golden age" of digital evidence gathering offered by older storage 
types.

"Given the pace of development in SSD memory and controller technology, 
and the increasingly proliferation [sic] of manufacturers, drives, and 
firmware versions, it will probably never be possible to remove or 
narrow this new grey area within the forensic and legal domain," the 
scientists, from Australia's Murdoch University, wrote. "It seems 
possible that the golden age for forensic recovery and analysis of 
deleted data and deleted metadata may now be ending."

For decades, investigators have worked with tape, floppy drives and hard 
drives that continue to store huge amounts of information even when the 
files they're contained in are marked for deletion. Even wiping the 
disks isn't always enough to permanently erase the contents. SSDs, by 
contrast, store data in blocks or pages of NAND-based transistor chips 
that must be electronically erased before they can be reused.

[...]


___________________________________________________________      
Tegatai Managed Colocation: Four Provider Blended
Tier-1 Bandwidth, Fortinet Universal Threat Management,
Natural Disaster Avoidance, Always-On Power Delivery 
Network, Cisco Switches, SAS 70 Type II Datacenter. 
Find peace of mind, Defend your Critical Infrastructure.
http://www.tegataiphoenix.com/